Search: CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.