Overview
CISA added CVE-2026-96652, a server-side request forgery (SSRF) flaw in Plex Media Server, to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. The flaw is in the /player/timeline endpoint. An attacker holding any X-Plex-Token value can place a full URL in the protocol parameter and force the server to send a POST request to a destination of their choosing.
On its own the bug is scored modestly (CVSS 4.3–5.3 depending on the source), but it is the first link in a public exploit chain nicknamed Plex2Shell, which combines CVE-2026-96652 with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to reach unauthenticated remote code execution. The chain as a whole is rated around CVSS 9.8.
Exploitation Status
- A researcher published a public proof-of-concept on October 16.
- Exploitation was observed on a honeypot the following day.
- Plex confirmed on October 19 that the issue is being "actively and widely exploited."
- Observed payloads include the XMRig cryptominer, and attackers are also installing proxy software on compromised servers.
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Plex Media Server | Versions before 1.43.3.10861 | 1.43.3.10861 and later |
Why It Matters
Plex servers are frequently exposed directly to the internet for remote streaming, and many run on home NAS devices or lab hosts that sit next to other sensitive systems. An SSRF primitive lets an attacker pivot requests through the server toward internal services, and chained with the other three CVEs it becomes a path to code execution on the host.
Updating does not remove an existing infection. Plex's guidance is to assume that a vulnerable, internet-facing server may already be compromised.
Recommended Actions
- Update Plex Media Server to 1.43.3.10861 or newer immediately.
- Remove direct internet exposure where possible. Put the server behind a VPN or an authenticated reverse proxy rather than forwarding the port.
- Hunt for compromise: look for unexpected processes (miners such as XMRig), unfamiliar scheduled tasks or services, and outbound connections to unknown hosts.
- Rotate credentials that were reachable from the host, including Plex tokens and any API keys or share credentials stored on the system.
- Federal agencies should follow the KEV remediation deadline set by CISA.