Four vulnerabilities in Plex Media Server are now being exploited in real attacks, and the U.S. Cybersecurity and Infrastructure Security Agency has added them to its Known Exploited Vulnerabilities catalog. The flaws are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together in what researchers call Plex2Shell, they let an attacker steal the server owner’s admin token and run code with elevated privileges. Federal agencies have until Oct. 23 to patch or apply mitigations.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Plex shipped a fix weeks before any of this became public, which makes the story a patching failure as much as a security one. Servers running a version older than 1.43.3.10861 remain exposed, and the sequence of events shows how quickly a quiet fix becomes an active threat once the technical details are public: researcher disclosure on Oct. 16, reported attacks on Oct. 17, a working proof of concept within days, and a federal warning on Oct. 21. Anyone who runs a Plex server for a household or small office is the practical audience for this notice.
The four CVEs and what each one does
BleepingComputer, which reported CISA’s warning on Oct. 21, breaks the chain into its parts. CVE-2026-96652 is a server-side request forgery in the /player/timeline path, through which unauthenticated attackers can make Plex send POST requests to arbitrary destinations, including its own internal APIs. CVE-2026-96654 is a URL injection through searchOne that lets attackers invoke other plugins’ functions with parameters they control.
CVE-2026-96655 is an authenticated server-side request forgery in the transcoder endpoint, letting a user make Plex request arbitrary internal or external addresses. CVE-2026-96656 is an arbitrary file write through transcoder settings: an administrator can plant malicious shared libraries that Plex later loads, which leads to code execution. Individually the flaws are rated medium to high, but the researcher who found them assigns the full chain a critical score.
How the researcher chained them
That score is 9.8 on the CVSS 3.1 scale, according to the researcher’s own Plex2Shell write-up, which describes an unauthenticated remote code execution that starts with the request forgery and ends with code running as the plex user. Security researcher Zach Main reported the problems to Plex on July 27, and the post says Plex acknowledged the report and paid a bounty on Aug. 4. CVE identifiers were assigned on Sept. 23, and Main published full technical details on Oct. 16, thanking the Plex security team for its quick response and fixes.
The logic of the chain is that each weak link supplies what the next one lacks. The first flaw needs no login and reaches internal services, the second turns that access into calls to other plugins, and the last two get an attacker from internal requests to a planted library that the server executes. Public disclosure of such a sequence is what turns a patched bug into an urgent one, because attackers no longer have to work out the path themselves and can simply scan for servers that have not updated.
Exploitation, exposure and the fix
Reports of attacks in the wild emerged on Oct. 17, a day after publication, according to BleepingComputer, which says attackers initially targeted Plex honeypots to deploy a cryptominer. A hobbyist security blog also documented exploitation of the vulnerabilities, and a proof-of-concept exploit followed about three days after the disclosure. CISA’s catalog entry, added on Oct. 21, moved the problem from a researcher’s blog to a federal deadline that applies to civilian agencies.
Plex users are the real audience. An earlier BleepingComputer report on more than 36,000 unpatched Plex servers, dated Sept. 9, said the nonprofit Shadowserver Foundation had been counting internet-exposed servers still on version 1.43.2 or earlier since Sept. 4, and that Plex urged owners to update as soon as possible to version 1.43.3. That earlier count predates the exploitation reports by more than a month, so it should not be read as the number exposed to Plex2Shell today.
The remedy for the four CVEs is the version BleepingComputer names: Plex Media Server 1.43.3.10861, which Plex announced in its forum release thread. Servers earlier than that build are affected. Owners running Plex on network-attached storage may need to install the update by hand if their device’s package manager has not yet offered it, the earlier report notes, and anyone whose server has been open to the internet while unpatched has reason to check for unfamiliar accounts, libraries or processes.
The same CISA update added unrelated flaws, including one in Siemens Software Center and one in SiteGuard Server Edition WAF, so the Plex entry is one of several in a routine batch. Organizations outside the federal government are not bound by the Oct. 23 date, but the Known Exploited Vulnerabilities catalog is widely used as a prioritization list, and an entry there means exploitation has been confirmed.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
