Plex2Shell Reached CISA's KEV 78 Days After Plex Shipped the Fix
Security / news
Plex2Shell Reached CISA's KEV 78 Days After Plex Shipped the Fix
Four Plex Media Server flaws chain into unauthenticated code execution on any server older than 1.43.3.10861, and attackers were installing miners within a day of a public proof of concept.
A remote attacker with no account can run code on a Plex Media Server older than 1.43.3.10861 by chaining four flaws, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The server must be reachable from the internet.Plex shipped the fix on August 3, 2026, and CISA listed all four as exploited on October 20, 78 days later.
Plex's own advisory says the vulnerabilities are "being actively and widely exploited" and that a public proof of concept appeared on October 16. The server update to install is 1.43.3.10861 or later.
Timeline from disclosure to KEV
| Date | Event | Source |
|---|---|---|
| July 27 | Researcher Zach Main reports the flaws to Plex | The Hacker News |
| August 3 | Plex Media Server 1.43.3.10861 ships | The Hacker News |
| September 1 | Plex urges updates, CVEs still pending | Plex forum |
| October 16 | Technical details and proof of concept public | Plex forum |
| October 19 | Plex posts CVE details; exploitation reported | Plex forum |
| October 20 | CISA adds all four to KEV | CISA KEV catalog |
- Report to fix7 days
- Fix to public proof of concept74 days
- Proof of concept to KEV listing4 days
Source: Dates from The Hacker News, Plex forum and CISA KEV catalog, accessed 2026-11-07
The gap that matters is the middle one. A patched server was safe only if its owner installed the update, and Plex's September 1 post gave no CVE numbers, 48 days before the details arrived.
What each flaw does
Scores and descriptions below are from The Hacker News; deadlines are from the KEV catalog.
| CVE | Weakness | CVSS | KEV deadline |
|---|---|---|---|
| CVE-2026-96652 | Unauthenticated SSRF via the player timeline endpoint | 5.3 | November 3 |
| CVE-2026-96654 | Calling other plugins' functions, obtaining the owner's admin token | 6.9 | October 23 |
| CVE-2026-96655 | SSRF via the transcode path for an authenticated user | 5.3 | November 3 |
| CVE-2026-96656 | Arbitrary file write to the Codecs directory | 8.6 | October 23 |
A fifth flaw, CVE-2026-96651 (CVSS 7.1), was disclosed alongside them but is not in the KEV catalog.
The sources disagree on two entries. The Hacker News and CISA describe CVE-2026-96655 as an SSRF through the /video/:/transcode/universal path. Plex's forum post summarises the same ID as disclosure of the server owner's admin token, and describes CVE-2026-96654 as access to internal agent functions over loopback. Check the CVE record before relying on a single ID.
The score understates the chain. No individual flaw except CVE-2026-96656 rates above 6.9, yet together they give an unauthenticated attacker code execution with the Plex process's privileges. The Hacker News says CVE-2026-96656 writes an ELF shared object into the Codecs directory and executes it. CISA marked only that one for forensic triage, which carries its 3-day deadline.
What the attackers installed
The Hacker News reports that exploitation began a day after the technical details were published. A shell script fetches a miner named x12345 with wget or curl, and attackers also deploy an XMRig miner called mylovelyminer and a Linux proxy backdoor called myawesomeproxy. Running the proxy prints a message that doing so "makes you agree to the potential external use of your internet traffic."
Bitsight flagged one of the attackers' subdomains in August for ties to the AISURU botnet, per the same report. Reddit users report mylovelyminer infections, though it is unknown whether Plex2Shell caused them.
What to do on a Plex server
Plex's guidance is to update, then check for compromise. Look for processes started by Plex Media Server that you do not recognise, such as myawesomeproxy, mylovelyminer or x12345. Look for unfamiliar .so or .dll files in the Codecs folder and outbound connections to proxystream.st.
Plex says: "If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised." For those servers it advises a clean reinstall, signing out of all devices, changing the Plex password, and treating mounted shares and stored credentials as exposed.
We have covered two other KEV entries: PHP2Shell with Fragnesia and the VMware ESX logging flaw.
Sources
More in Security
- 01Apple's CVE-2024-27834, Patched in May 2024, Reaches CISA's KEV on Sekoia's Report of an APT29-Linked Web CampaignA 5.5-rated pointer authentication bypass is the second stage of an iOS 16.7 cookie-stealing chain. Sekoia's report also names a Plerdy SEO Tracker compromise and an Android chain.
- 02CISA's BOD 26-04 Deadlines: 120 of 152 KEV Entries Since June Carry a Three-Day DeadlineThe directive that replaced BOD 22-01 on June 10 sets deadlines by exposure and exploit risk, and the catalog shows the short window is now the norm.
- 03VMware ESX Flaw Rated 2.7 Was a Zero-Day for Warp PandaCVE-2026-41709 lets an administrator skip the audit log, CrowdStrike says a China-nexus group used it in early 2026, and ESXi 7.0 has no listed fix.
- 04CERT-In's 107-Page AI Audit Rules Set Four Risk TiersThe Nov. 4 guidelines tie audit frequency and remediation deadlines to a system's tier, and RBI's separate API advisory carries its own Dec. 3 and Feb. 3 dates.