CISA has confirmed that attackers are exploiting these 2 vulnerabilities. If you use any of the products below, check that the fixes are installed today.
Plex Media Server (CVE-2026-96652)
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Siemens Software Center (CVE-2026-110936)
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Pause before you click
Urgent emails about invoices, deliveries or locked accounts are the usual way in. Open the site yourself rather than following the link.
Doing it once, properly
Saving now often means paying twice: cut-price IT work is frequently rebuilt from the start, and the outage or breach before the rebuild is the expensive part.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-96652 on the National Vulnerability Database
- CVE-2026-110936 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.