Overview
CISA is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server, collectively called Plex2Shell. Chained together, they let an attacker obtain the owner's admin token and run code with elevated privileges. Researcher Zach Main scored the full chain 9.8 (critical), though the individual flaws rate medium to high.
The Four CVEs
| CVE | Flaw |
|---|---|
| CVE-2026-96652 | Unauthenticated SSRF in /player/timeline letting Plex send POST requests to arbitrary destinations, including internal APIs |
| CVE-2026-96654 | URL injection in searchOne that invokes other plugins' functions with attacker-controlled parameters |
| CVE-2026-96655 | Authenticated SSRF in the transcoder endpoint |
| CVE-2026-96656 | Arbitrary file write in transcoder settings; admins can plant shared libraries Plex later loads, leading to code execution |
Timeline
- July 27: flaws reported to Plex
- October 16: full technical details published
- October 17: in-the-wild exploitation reported, initially against Plex honeypots to deploy a cryptominer
- October 19: proof-of-concept exploit released
CISA gave federal agencies until October 23 to patch or apply mitigations.
Affected and Fixed Versions
Plex Media Server versions before 1.43.3.10861 (released August 4) are affected. Update to 1.43.3.10861 or later.
Other KEV Additions
- Siemens Software Center, CVE-2026-110936: uncontrolled search path flaw exploited in campaigns tied to the Romulus ClickFix delivery platform; update to 4.0.9.8 or later
- SiteGuard WAF, CVE-2026-106931: OS command injection; upgrade to Server Edition 8.00 Update 5 (Apache httpd, Nginx, IIS) or 7.00 Update 6 (Apache httpd and Nginx on FreeBSD)
Recommended Actions
- Update Plex Media Server to 1.43.3.10861 or later
- Do not expose Plex directly to the internet; restrict access via VPN or reverse proxy with authentication
- Rotate Plex tokens and review transcoder settings for unexpected shared libraries
- Hunt for cryptominer processes on Plex hosts