CVE-2026-96652MalwarePublished 10/19/2026

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Affects Plex Media ServerSource AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 10/20/2026
KEV deadline: 11/03/2026
EPSS: 0.5% chance of exploitation in 30 days – higher than 38% of CVEs

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected software

Product	Affected	Fixed in
GitHub Actionsplexinc/plex-media-server`pkg:github/plexinc/plex-media-server`Other threats	Affected <=1.43.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to deploy cryptominer and proxy malware. Attackers chain four CVEs to achieve remote code execution on vulnerable servers. Exploitation attempts were observed starting October 17, 2026, with payloads including the XMRig cryptominer and myawesomeproxy software. The proxy tool may allow threat actors to use residential IPs to access corporate VPNs and email systems. Proof-of-concept code is publicly available via the plex2shell project. Exploitation was detected from multiple IP addresses, with malicious payloads downloaded from a known IP. No patch or remediation status is provided in the available data.

Summary

In September 2026, multiple vulnerabilities affecting Plex Media Server up to version 1.43.2 were disclosed. These vulnerabilities are chained together to enable remote code execution on vulnerable Plex servers. Starting October 17, 2026, exploitation attempts were captured by honeypots, showing attackers deploying the XMRig cryptominer and a proxy tool named myawesomeproxy. The proxy software potentially facilitates threat actors in leveraging residential IP addresses to access corporate VPNs and email systems. The attack infrastructure includes multiple attacker IP addresses and a malicious payload host. Public proof-of-concept exploit code is available through the plex2shell project, increasing the risk of exploitation. No official patch or remediation information is provided in the source data.

Impact

Successful exploitation leads to remote code execution on Plex Media Server instances, allowing attackers to deploy cryptomining malware (XMRig) and proxy software (myawesomeproxy). This results in unauthorized resource consumption and potential misuse of compromised systems as proxies to access corporate networks. The presence of publicly available proof-of-concept code increases the likelihood of further exploitation. The impact includes resource exhaustion, potential network abuse, and increased risk to corporate infrastructure accessed via compromised proxies.

Defensive guidance

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or mitigations are available, organizations should consider restricting network exposure of Plex Media Server instances and monitor for indicators of compromise such as connections to known malicious IPs and hashes associated with the cryptominer and proxy malware. Applying network-level controls to block communication with the identified malicious IP 217.60.194.116 may help reduce risk.

Weaknesses

CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)

Indicators of compromise

Hashes 10

b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22
343427f5c7d42fe23a2b8e31e37168c2
e1b3e738928012a07dfce8659b3ff31d
b6bbb136374f076cca722dd846fa467585fbc2c7
c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db
5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441
68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7
e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9

CVEs 4

CVE-2026-96652
CVE-2026-96654
CVE-2026-96655
CVE-2026-96656

IP addresses 1

217.60.194.116