Enterprise & KEV Exploit Chains: Plex2Shell RCE, Siemens "Romulus" DLL Sideloading (CVE-2026-110936), FortiSIEM gRPC & Cisco Expressway

Beyond core language runtimes and VPN gateways, CISA’s late-October KEV additions and major enterprise advisories highlighted how attackers are chaining multi-bug vulnerabilities across media servers, industrial engineering workstations, and SIEM collectors. Over the weekend, threat trackers documented sustained botnet and proxy-malware exploitation of the four-bug Plex2Shell chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), active ClickFix campaigns abusing a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) to deploy the Romulus RAT, public PoC exploitation risks targeting Fortinet FortiSIEM’s gRPC collector (CVE-2026-106173, CVSS 9.8), Cisco Expressway’s clustering database RCE (CVE-2026-76466, CVSS 9.8), and Oracle’s massive 1,295-patch October Critical Patch Update containing six CVSS 10.0 flaws.

1. The 4-Bug "Plex2Shell" CISA KEV Chain (CVE-2026-96652 through CVE-2026-96656)

While often thought of as a consumer application, Plex Media Server frequently runs on developer workstations, home-office networks bridged to corporate VPNs, and enterprise media/marketing NAS appliances. Added to the CISA KEV catalog under BOD 26-04, Plex2Shell chains four distinct vulnerabilities in versions prior to 1.43.3.10861 to turn an unauthenticated network request into native code execution:

1. Stage 1 — Unauthenticated SSRF (CVE-2026-96652): The endpoint GET /player/timeline fails to validate the target host/port parameters when polling remote player state, allowing an unauthenticated remote attacker to forge loopback HTTP requests directly to 127.0.0.1:32400 (where Plex trusts local administrative endpoints implicitly).
2. Stage 2 — URI Injection & Admin Token Theft (CVE-2026-96654): Chaining the loopback SSRF into /Search/searchOne with crafted URI scheme parameters causes the internal parser to leak the server owner’s master X-Plex-Token back to the attacker.
3. Stage 3 — Authenticated Transcoder SSRF (CVE-2026-96655): Armed with the stolen X-Plex-Token, the attacker invokes /video/:/transcode/universal to force the server to fetch and cache an attacker-controlled binary blob (a compiled shared library .so or .dll) into a known local cache directory.
4. Stage 4 — FFmpeg Option Injection to dlopen() RCE (CVE-2026-96656): Finally, the attacker modifies the server’s TranscoderH264Options preference to inject custom FFmpeg command-line arguments that load the staged shared object via dlopen()—executing arbitrary C constructor code immediately upon triggering a video transcode.

2. Siemens Software Center DLL Sideloading (CVE-2026-110936) & the "Romulus" Campaign

Also added to CISA’s KEV catalog is CVE-2026-110936 (CVSS 7.8, CWE-427 Uncontrolled Search Path Element) in Siemens Software Center (SSC) versions prior to 4.0.9.8—the central deployment and licensing client used across industrial CAD, Product Lifecycle Management (PLM), and OT engineering environments.

In the wild, operators of the Romulus multi-stage loader campaign pair CVE-2026-110936 with ClickFix social engineering lures:

• Victims visiting compromised or malvertising engineering portals are presented with a fake "Cloudflare / Browser Verification" modal instructing them to press Win + R, paste a clipboard command (powershell / mshta), and press Enter.
• Instead of dropping an unsigned malware executable that Windows Defender or SmartScreen would block, the script downloads a legitimate, EV code-signed copy of an older SiemensSoftwareCenter.exe binary alongside a maliciously crafted archive.dll into the same user-writable folder.
• When SiemensSoftwareCenter.exe launches, it calls LoadLibraryExW("archive.dll") without restricting the search path to System32 or verifying the Authenticode signature of the loaded DLL—executing the Romulus RAT inside the memory space of a trusted Siemens-signed process.

3. FortiSIEM gRPC RCE (CVE-2026-106173), Cisco Expressway (CVE-2026-76466) & Oracle’s 1,295-Patch CPU

Enterprise infrastructure teams must also prioritize three critical core advisories from this cycle:

• Fortinet FortiSIEM 7.5.0 Pre-Auth gRPC RCE (CVE-2026-106173, CVSS 9.8): A path traversal flaw (../../) in the SendQueryResult RPC method exposed on TCP port 27918 (the phQueryMaster / gRPC service) allows an unauthenticated remote attacker to write arbitrary files (such as cron jobs or SSH keys) to the underlying operating system. With public PoC exploit code circulating, upgrading to FortiSIEM 7.5.1 is mandatory.
• Cisco Expressway Series Clustering RCE (CVE-2026-76466, CVSS 9.8): Improper TLS client certificate validation during cluster database synchronization combined with persistent cookie trust allows an unauthenticated remote attacker to spoof a cluster peer and execute arbitrary OS commands as root.
• Oracle October 2026 Critical Patch Update (1,295 Fixes): Oracle shipped 1,295 security patches across its portfolio, headlined by six maximum-severity CVSS 10.0 pre-auth vulnerabilities affecting Oracle Access Manager, Oracle SOA Suite, Oracle E-Business Suite Workflow Mailer, and JD Edwards EnterpriseOne Orchestrator.

Detection Telemetry & Hunting Queries

Remediation Priorities

1. Patch Plex Media Server & Inspect Preferences: Update Plex Media Server to 1.43.3.10861+, remove any port-forwarding rules exposing port 32400 directly to the internet, and inspect Preferences.xml for unauthorized TranscoderH264Options attributes.
2. Upgrade Siemens Software Center & Block ClickFix: Upgrade SSC to 4.0.9.8+ (which enforces strict DLL signature verification) and disable the Windows Win + R Run dialog via Group Policy (NoRun) for standard users to neutralize ClickFix lures.
3. Patch FortiSIEM, Cisco Expressway & Oracle Core: Upgrade FortiSIEM to 7.5.1, apply Cisco Expressway X15.x patches for CVE-2026-76466, and prioritize Oracle’s six CVSS 10.0 patches in Access Manager, EBS, and SOA Suite.