CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

The Plex2Shell vulnerabilities consist of four distinct flaws in Plex Media Server: CVE-2026-96652 (unauthenticated SSRF via /player/timeline), CVE-2026-96654 (URL injection in searchOne allowing invocation of other plugins), CVE-2026-96655 (authenticated SSRF in the transcoder endpoint), and CVE-2026-96656 (arbitrary file write in transcoder settings enabling malicious shared library loading). When chained, these allow attackers to steal admin tokens and execute arbitrary code with elevated privileges on affected Plex Media Server instances. The vulnerabilities were responsibly disclosed in July 2026, with technical details and proof-of-concept exploits published in October 2026. Exploitation in the wild has been observed, including cryptominer deployment on Plex honeypots. The affected versions are all Plex Media Server versions prior to 1.43.3.10861, which was released on August 4, 2026.

Successful exploitation of the Plex2Shell vulnerabilities allows attackers to obtain the owner's admin token and execute arbitrary code with elevated privileges on the Plex Media Server. This can lead to full compromise of the server, unauthorized access to media content, and potential use of the server as a foothold for further attacks. Active exploitation has been observed in the wild, including cryptominer deployment.

An official patch is available in Plex Media Server version 1.43.3.10861 released on August 4, 2026. CISA directs immediate prioritization of patching or applying mitigations by October 23, 2026. Users should upgrade affected Plex Media Server instances to version 1.43.3.10861 or later to remediate these vulnerabilities.