CISA has added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalog after Plex confirmed that attackers are chaining the flaws to compromise internet-facing servers.
The attack chain, known as Plex2Shell, allows an unauthenticated remote attacker to execute code with the privileges of the Plex Media Server process. Compromised systems have been used for cryptocurrency mining and as proxy servers that route other people’s internet traffic through victims’ connections.
Plex is advising administrators operating vulnerable, internet-accessible servers to assume that their systems may already be compromised.
FOUR VULNERABILITIES FORM A REMOTE-CODE-EXECUTION CHAIN
Plex2Shell combines four separate vulnerabilities:
- CVE-2026-96652: Unauthenticated server-side request forgery in the player timeline endpoint
- CVE-2026-96654: Access to internal agent functions through the loopback interface
- CVE-2026-96655: Disclosure of the server owner’s administrative token
- CVE-2026-96656: Arbitrary file writing to the Codecs directory through transcoder preferences
Individually, several of the vulnerabilities received moderate or high severity ratings. Chained together, however, they allow an unauthenticated attacker to move from external access to administrative token theft, arbitrary file placement and remote code execution.
This demonstrates why defenders should not evaluate related vulnerabilities only by their individual severity scores. A sequence of lower-rated flaws may produce a critical final outcome.
PUBLIC EXPLOIT TRIGGERED WIDESPREAD ATTACKS
Plex corrected the vulnerabilities in Plex Media Server 1.43.3.10861, which was released in August. However, a public proof of concept appeared on October 16, creating an immediate exploitation risk for servers that had not installed the update.
Plex said it subsequently observed widespread attacks against unpatched, internet-facing systems.
The company confirmed that attackers have deployed cryptocurrency miners and proxy software. Proxy malware can allow criminals to conceal later activity behind a victim’s residential or business internet address, potentially associating malicious traffic with the compromised server owner.
CISA added all four vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20. Their inclusion confirms that exploitation is occurring in real attacks rather than remaining a theoretical possibility.
REMOTE ACCESS SHOULD BE LIMITED
Server owners who do not require remote streaming should disable Remote Access in Plex settings.
Administrators should avoid directly forwarding TCP port 32400 to the internet unless remote connectivity is necessary. Firewall restrictions, VPN access, network segmentation and reverse-proxy controls can reduce exposure, but they do not replace the required security update.
Plex servers should also run with the minimum file-system and network permissions necessary. The service account should not have broad access to sensitive documents, backups or administrative credentials simp