CVE-2026-106931 and Plex CVEs: patch actively exploited servers now

At a glance

Published and checked: 21 October 2026, 06:00 Europe/Riga. This update covers one actively exploited SiteGuard Server Edition flaw and a Plex Media Server chain that Plex says is actively and widely exploited. Treat an exposed affected server as an incident until evidence shows otherwise.

CISA KEV: the SiteGuard and Plex CVEs were added on 20 October 2026. Inclusion is evidence of known exploitation, not proof that a particular host has been compromised. EPSS: no reliable dated EPSS value was available during this review. CVSS: SiteGuard is rated 8.5 CVSS v4.0 by its vendor; Plex has not assigned a CVSS value in its advisory. Urgency comes from exploitation, exposure and an available fix.

Immediate decision

1. Record each affected host, its installed version, exposure history and current service state.
2. Preserve logs and diagnostics before changing the system.
3. Remove unnecessary public exposure while arranging the supported update.
4. Patch, validate the version and service function, then investigate whether a rebuild and credential rotation are required.

CVE-2026-106931: SiteGuard Server Edition

EG Secure Solutions reports an OS command injection issue in the SiteGuard Server Edition Statistics feature. The feature is enabled by default. The vendor confirms exploitation and says execution can occur as root or SYSTEM. Its public CVSS vector describes a privileged local-authentication path; the notice does not establish that every internet-facing SiteGuard server can be compromised anonymously.

Determine whether you are affected

Use the approved SiteGuard management interface to record the edition, installed version and whether Statistics is enabled. Apache, Nginx and IIS editions before 8.00 Update5 are affected. FreeBSD Apache and Nginx editions before 7.00 Update6 are affected. IIS editions 3.10 through 4.00 Update4 are explicitly not affected.

Before an update, download the vendor's Diagnostic Information and store it with collection time and integrity information in the incident evidence location. The vendor warns that upgrading or patching can remove attack traces. Do not attempt exploitation to test the condition.

Patch and validate

1. Download diagnostic information from the management interface.
2. Obtain the update through EG Secure Solutions' supported channel.
3. Install 8.00 Update5 or later for Apache, Nginx and IIS editions; use 7.00 Update6 or later for supported FreeBSD Apache/Nginx editions.
4. Confirm the corrected version after restart and test normal protected-site operation.
5. Review preserved diagnostics and security monitoring for unexpected privileged process activity.

If compromise cannot be ruled out, isolate the host and follow the incident-response process. A patch removes the vulnerable code; it does not prove recovery. Any rollback should use the vendor-supported restore method and must retain compensating management-access restrictions because it may reintroduce the vulnerable release.

Plex Media Server CVE chain

Plex states that CVE-2026-96652, -96654, -96655 and -96656 affect Plex Media Server 1.43.2 and earlier. The advisory describes an unauthenticated SSRF, loopback agent-function access, server-owner token disclosure and an arbitrary Codecs-directory write. Plex says the chain can lead to code execution with the Plex Media Server process account and is actively and widely exploited.

Do not describe one of these CVEs as independently producing code execution: Plex's statement concerns the chain. Plex says internet-reachable servers below 1.43.3.10861 should be treated as potentially compromised.

Determine exposure safely

In Plex Web, open Settings → General and record the server version. Then review Settings → Remote Access and any approved firewall or port-forwarding inventory. A server at 1.43.3.10861 or later is outside Plex's stated affected range. A server at 1.43.2 or earlier is affected; remote reachability raises urgency.

A DNS record or an open TCP port proves only that a related endpoint is published or accepting connections. It does not prove that Plex is reachable, vulnerable or compromised. Use authorised configuration and version review rather than active tests against systems you do not own.

Patch and validate

1. Preserve the version, remote-access state, relevant logs and current process information.
2. Install Plex Media Server 1.43.3.10861 or later from Plex's official download route or the supported package workflow for the host platform.
3. Confirm the version in Settings → General after the normal restart procedure.
4. Test one authorised local stream and scheduled tasks.
5. Investigate unexpected processes started by Plex, unfamiliar files in the Codecs directory, unusual outbound connections and unexplained sustained CPU use.
6. If the server was exposed while vulnerable and compromise cannot be ruled out, rebuild from a clean installation. Sign out sessions, change the Plex password, and review shares and credentials reachable by the Plex service account.
7. Turn off Remote Access and remove direct port-forwarding for 32400 if it is not required.

Availability validation does not establish that compromise did not occur. Do not routinely downgrade to a vulnerable package as rollback.

Why the evidence labels matter

SiteGuard has confirmed exploitation of its vulnerability. Plex has reported active and widespread exploitation of the four-CVE chain and supplied a fixed build. CISA KEV corroborates that the vulnerabilities are known to be exploited. Those sources do not establish compromise of a particular organisation. Version, enabled configuration, exposure history and preserved evidence are the defensible basis for the next decision.

Changes log

• 21 October 2026: Initial publication. Recorded vendor fixes, CISA KEV status and safe validation paths.

References

1. EG Secure Solutions: SiteGuard Server Edition OS command injection (CVE-2026-106931)
2. Plex: Important Security Update for Plex Media Server v1.43.2 and earlier
3. CISA Known Exploited Vulnerabilities Catalog
4. NVD CVE API record: CVE-2026-106931
5. NVD CVE API record: CVE-2026-96656