critical severityConfidence highHistorical record

Plex Media Server hijacked without a login through the Plex2Shell chain, on CISA KEV (CVE-2026-96652)

Plex2Shell chains four Plex Media Server bugs fixed in 1.43.3.10861: an SSRF in /player/timeline that accepts any X-Plex-Token value (CVE-2026-96652), unescaped identifiers in the loopback-only agent searchOne API that let an attacker call other plugins' functions (CVE-2026-96654), a transcoder path SSRF and owner-token exposure (CVE-2026-96655), and an admin file write through the TranscoderH264Options preference that drops a shared library into the Codecs folder, which Plex loads on the next transcode (CVE-2026-96656). Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. A public proof of concept was released on 2026-10-16, a honeypot recorded in-the-wild exploitation on 2026-10-17 delivering an XMRig-based miner and myawesomeproxy proxy software, Plex confirmed active and widespread exploitation on 2026-10-19, and CISA added all four CVEs to KEV on 2026-10-20.

Also tracked as CVE-2026-96652 · CVE-2026-96654 · CVE-2026-96655 · CVE-2026-96656 · Plex2Shell · Plex Media Server RCE chain · Plex cryptominer

First observed
Oct 17, 2026
Last observed
Oct 19, 2026
Last reviewed
Oct 20, 2026
Tracking ended
Oct 19, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Individual CVE scores are medium to high (CVSS 4.0 5.3, 6.9, 5.3, 8.6); the critical rating reflects Plex's statement that the chain gives unauthenticated code execution and is widely exploited. Published indicators come from one honeypot over a short window. The CVE record and Plex's summary describe CVE-2026-96655 differently (transcoder path SSRF vs owner admin token disclosure). Honeypot attacker and payload-host IP addresses are listed in the cited honeypot post and are omitted here.

  • Servers on 1.43.3.10861 or newer are not affected per Plex; prior exposure still needs the compromise checks
  • The chain targets Plex Media Server, not Plex client apps
  • Servers not reachable from the internet are outside the internet-wide attacks Plex describes, but a LAN attacker can still run the chain
  • Not an attack on plex.tv or Plex cloud accounts
  • Updating does not remove an existing miner, proxy, Codecs-folder library or attacker-set preference

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Update

    Researcher reports the chain to Plex security.

  2. Vendor action

    Plex announces Plex Media Server 1.43.3 security update and asks all server owners to update.

  3. Disclosure

    CVE-2026-96651 through -96656 published with CISA CSAF advisory VA-26-266-01; fixed in 1.43.3.10861.

  4. Disclosure

    Plex2Shell write-up and proof-of-concept exploit published.

  5. First observed

    Honeypot records in-the-wild exploitation dropping an XMRig-based miner, later myawesomeproxy.

  6. Vendor action

    Plex confirms active and widespread exploitation and publishes compromise checks.

  7. Update

    CISA adds CVE-2026-96652, -96654, -96655 and -96656 to KEV (catalog 2026.10.20); due 2026-10-23 for 96654/96656 and 2026-11-03 for 96652/96655; forensic triage flagged for 96656.

Publication clock: 652.9 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Plex Media Server@<1.43.3.10861genericpackage

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

2 indicators are recorded as not defanged. Treat them as live.

  • file hashmedium confidencenot defanged
    e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9
  • file hashmedium confidencenot defanged
    2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-DB59475C