Plex2Shell Chains Four CVEs Into Unauthenticated Code Execution; CISA Lists It as Exploited

An unauthenticated remote attacker who can reach a Plex Media Server (port 32400 is often exposed directly to the internet) can chain four flaws into code execution as the plex user, and CISA says the chain is being exploited. Servers older than 1.43.3.10861 are affected, and federal civilian agencies were given until October 23 to patch or mitigate.

Updating to 1.43.3.10861 or later closes the chain. BleepingComputer lists that build as released August 4, so the fix has been available for roughly 11 weeks.

The four CVEs and what each contributes

The researcher who found them, publishing as zmain.info (GitHub handle code-zm), scores the full chain 9.8 under CVSS v3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. BleepingComputer notes that the four flaws taken one at a time are rated medium to high.

CVE	Flaw	Needs
CVE-2026-96652	SSRF in /player/timeline	Nothing
CVE-2026-96654	URL injection in searchOne	Reaching plugin functions
CVE-2026-96655	SSRF in transcoder endpoint	Authenticated user
CVE-2026-96656	Arbitrary file write in transcoder settings	Admin access

The score understates how little the first link demands. Per the researcher's write-up, the companion /player endpoints check only that an X-Plex-Token header is present, not that it is valid. His own phrasing of the root flaw: "hasParam() checks existence, not validity".

How the chain reaches code execution

The write-up lays out five steps. The server is made to send a request to itself on loopback; the /system/agents API trusts that loopback traffic; and a guard in the agent service fails because its decorator discards the return value.

The plugin framework then attaches the owner's admin token to outbound requests whose URL begins with http://127.0.0.1. That prefix match is unbounded, so an attacker-controlled hostname that starts with the same string receives the token.

With admin access, the attacker changes a transcoder option and uses a debug feature to write bytes into the codec directory. The transcoder loads shared objects from there, and the planted file's constructor runs as plex. The proof of concept on GitHub forks a reverse shell back to the attacker.

Timeline from report to KEV listing

• July 27, 2026: reported to Plex's security team.
• August 4: Plex acknowledged the report and paid a bounty; the same day is the release date BleepingComputer gives for 1.43.3.10861.
• September 23: CVEs assigned.
• October 16: full technical details published.
• October 17: reports of exploitation, initially against Plex honeypots to deploy a cryptominer, per BleepingComputer.
• October 21: BleepingComputer reports that CISA has added the flaws to its Known Exploited Vulnerabilities catalog.

The exploitation claim rests on CISA's listing and the honeypot reports BleepingComputer cites; the article does not say how many real servers were compromised.

The same KEV update also added two unrelated entries: CVE-2026-110936 in Siemens Software Center (fixed in 4.0.9.8) and CVE-2026-106931, an OS command injection in SiteGuard WAF. For another case where attacks began before a fix was widely applied, see the PHP2Shell timeline. Another maximum-severity remote code execution fix landed the same week in GitLab 19.5.1.

What to do now

Update to Plex Media Server 1.43.3.10861 or later. If you cannot, stop forwarding port 32400 to the internet and check the codec directory for files you did not put there. On a server that was reachable from the internet before updating, it is prudent to assume the owner token may have leaked.