The Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited critical remote code execution (RCE) vulnerability, potentially connected to the August 2022 LastPass breach, to its catalog of Known Exploited Vulnerabilities (KEV). The flaw, tracked as CVE-2020-5741, affects Plex Media Server, a central media hub where customers can access personal media on their own servers as well as stream free and on-demand movies and music. A threat actor that has previously gained access to a Plex Media Server administrator account could exploit Plex’s Camera Upload feature to upload a maliciously crafted file to the Plex server, which then executes with no user interaction. The flaw has been patched by Plex, and the company urges their customers to upgrade to version 1.19.3 or newer to prevent exploitation. Although this vulnerability has not been definitively attributed to the LastPass breach, researchers believe that it is likely. LastPass was compromised after threat actors targeted a DevOps engineer’s home computer, and LastPass officials stated that the attacker exploited “a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware”. Although LastPass has yet to confirm what vulnerability was exploited, they did admit that the exploited media software package was a Plex Media Server. The flaw’s presence on the KEV mandates that all Federal Civilian Executive Branch (FCEB) agencies must patch this flaw no later than March 31, 2023, or face regulatory accountability. The LastPass compromise has been a novel and very dynamic situation, with new updates frequently being published. CTIX analysts will continue to monitor this matter as well as report on the latest critical vulnerabilities.