Key points
- CISA warns attackers are actively exploiting four flaws known as Plex2Shell in Plex Media Server.
- The exploit chain allows unauthenticated attackers to obtain admin tokens and run privileged code.
- Vulnerabilities affect Plex Media Server versions prior to the 1.43.3.10861 release from August 4.
The short version
- Four specific vulnerabilities in Plex Media Server are being chained by attackers to breach servers.
- The collective threat, named Plex2Shell, enables remote code execution with elevated privileges.
- CISA has directed federal agencies to patch or mitigate these systems by October 23.
The details
The U.S. Cybersecurity and Infrastructure Security Agency issued a warning that attackers are actively exploiting four vulnerabilities within Plex Media Server, collectively dubbed Plex2Shell. According to BleepingComputer, these flaws allow an attacker to obtain the server owner's admin token and execute code with elevated privileges. Plex Media Server is a widely used suite for organizing and streaming personal media collections to devices locally or over the internet.
Security researcher Zach Main discovered the issues and responsibly reported them to Plex on July 27. While the individual flaws carry medium to high severity ratings, Main assigned the full exploit chain a critical score of 9.8. Main published full technical details on October 16, followed by a proof-of-concept exploit three days later. Reports of the exploits being used in the wild emerged on October 17, initially targeting honeypots to deploy cryptominers.
The context
The exploit chain relies on four specific CVEs. CVE-2026-96652 is an SSRF flaw in /player/timeline that lets unauthenticated attackers force Plex to send POST requests to arbitrary destinations. CVE-2026-96654 is a URL injection flaw in searchOne that allows invocation of other plugins with attacker-controlled parameters. CVE-2026-96655 is an authenticated SSRF flaw in the transcoder endpoint. CVE-2026-96656 is an arbitrary file write flaw that allows administrators to plant malicious libraries for code execution.
These vulnerabilities impact Plex Media Server versions before 1.43.3.10861, which was released on August 4. CISA has directed federal agencies to prioritize patching affected systems or apply mitigations by October 23. In a separate update, CISA added an uncontrolled search path flaw in Siemens Software Center to its Known Exploited Vulnerabilities catalog.
What should you do?
- Check your Plex Media Server version and ensure it is updated to 1.43.3.10861 or later.
- Review server logs for unusual activity or unauthorized access attempts, especially around October 17.
- Restrict internet access to your Plex server using firewall rules if remote access is not required.
- Monitor for unexpected processes or high CPU usage that could indicate cryptominer deployment.
For customers and users
If you run a Plex Media Server, verify your current version immediately against the patched release. Users should check for any unexpected admin permissions or new plugins installed without their consent. Look for signs of unauthorized access in your account history and change your passwords if you suspect compromise. Be wary of follow-up emails claiming to offer fixes for this issue, as attackers often send fraudulent support messages after a breach.
What to do and how to stay safe: Plex Media Server
- Update your Plex Media Server to the latest version provided by the vendor.
- Audit your server's admin tokens and revoke any that you do not recognize.
- Ensure your firewall is blocking unnecessary inbound connections to the server.
- Monitor system performance for signs of cryptomining or other unauthorized processes.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Plex Media Server versions are affected by Plex2Shell?
Versions before 1.43.3.10861, which was released on August 4, are impacted by these vulnerabilities.
What is the severity of the Plex2Shell exploit chain?
Researcher Zach Main assigned the full exploit chain a critical score of 9.8, despite individual flaws being rated medium to high.
Has CISA provided a deadline for patching these vulnerabilities?
Yes, CISA directed federal agencies to prioritize patching or applying mitigations by October 23.
