Plex2Shell Chains Four CVEs Scored 4.3 to 7.2 Into Code Execution, and CISA Says It Is Exploited
Security / news
Plex2Shell Chains Four CVEs Scored 4.3 to 7.2 Into Code Execution, and CISA Says It Is Exploited
Plex Media Server 1.43.3.10861 fixes all four. The public write-up came Oct. 16, and CISA gave agencies three days from Oct. 20.
Four Plex Media Server bugs that NVD scores between 4.3 and 7.2 add up to code execution for an attacker who can reach the server from the internet, according to Plex, and CISA lists all four as exploited. Servers older than 1.43.3.10861 are affected; the fix is that build or later.
The set is called Plex2Shell. CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its catalog on Oct. 20, with deadlines of Oct. 23 for CVE-2026-96654 and CVE-2026-96656 and Nov. 3 for the other two. Only CVE-2026-96656 carries the forensic-triage flag.
The four CVEs and their scores
| CVE | Flaw (NVD wording) | CVSS 3.1 |
|---|---|---|
| CVE-2026-96652 | SSRF via /player/timeline | 4.3 |
| CVE-2026-96654 | Unneutralized URL values in searchOne | 6.5 |
| CVE-2026-96655 | SSRF via /video/:/transcode/universal | 4.3 |
| CVE-2026-96656 | Arbitrary file write, loaded on startup | 7.2 |
- CVE-2026-966524.3 points
- CVE-2026-966546.5 points
- CVE-2026-966554.3 points
- CVE-2026-966567.2 points
Source: NIST National Vulnerability Database, CNA scores, accessed 2026-11-10
The score understates the chain. The last bug, the file write, requires an admin user (PR:H in NVD's vector). The NVD text for the first bug says an attacker "using any X-Plex-Token value" can force the server to POST to a chosen address, and Plex's own notice calls the issues unauthenticated and lists them as "Disclosure of the server owner's admin token" among the steps. Chained, Plex says, they let an "unauthenticated remote attacker run code with the privileges of the Plex Media Server process."
Timeline
BleepingComputer reports that researcher Zach Main reported the flaws to Plex on July 27 and that the fixed release came on Aug. 4. NVD published the CVE records on Sept. 23, and Plex's forum notice for servers 1.43.2 and earlier is dated Sept. 1.
Main published full technical details on Oct. 16. Reports of exploitation against Plex honeypots, deploying a cryptominer, began on Oct. 17, per BleepingComputer, which cites a Censys post and a blog. Plex's Oct. 19 update says the flaws are "being actively and widely exploited." CISA's entry followed on Oct. 20.
The sources disagree on when a working exploit became public. Plex puts a public proof of concept at Oct. 16; BleepingComputer says Main released one three days after the write-up. Either way, 73 days separated the fixed release from the public details.
What to do
Update to 1.43.3.10861 or later and confirm the number under Settings, General in Plex Web. Plex also says to stop forwarding port 32400 directly and to turn off remote access if it is not needed.
For a server that was reachable on an older build, Plex lists indicators: processes named myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in the Codecs folder, outbound connections to proxystream.st, and high idle CPU. If any appear, Plex advises a clean reinstall instead of reusing the data directory, signing out all devices, and changing the Plex password. Anything the service account could reach, such as mounted shares, should be treated as exposed.
For another exploited-list entry with a short federal deadline, see GPUStack's loopback bypass. The SonicWall MFA bypass is a separate entry on the same CISA list. Neither source fetched gives a count of compromised Plex servers.
Sources
More in Security
- 01LiteLLM's 9.9-Rated Chain Needs v1.83.14 to Close, and Two Dates for It DisagreeAn internal user with a default virtual key can reach proxy admin and then code execution; Obsidian dates the full fix April 25, The Hacker News says May 2.
- 02Hacktron Chained a libheif Overflow and an SSO Flaw to Reach OpenAI's MonorepoOpenAI fixed the OpenAI-side bug 14 hours after the July 25 report, paid $6,500, and on November 6 signed the same researchers for ongoing red-teaming.
- 03Google's LLMJacking Report Names the Cloud Log Events That Give Attackers AwayMandiant's November 2 write-up puts single-day fraud above $100,000, and its most useful pages are the audit-log calls to alert on in AWS, Azure and Google Cloud.
- 04Fireworks AI Says a Second Intrusion Reached Datasets and Model WeightsThe inference host's November 9 update contradicts its October 9 bulletin, and Notion has switched off its Insights feature after AI chat transcripts were caught up.