{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-DB59475C",
  "slug": "cve-2026-96652-plex-media-server-plex2shell-kev",
  "title": "Plex Media Server hijacked without a login through the Plex2Shell chain, on CISA KEV (CVE-2026-96652)",
  "aliases": [
    "CVE-2026-96652",
    "CVE-2026-96654",
    "CVE-2026-96655",
    "CVE-2026-96656",
    "Plex2Shell",
    "Plex Media Server RCE chain",
    "Plex cryptominer"
  ],
  "summary": "Plex2Shell chains four Plex Media Server bugs fixed in 1.43.3.10861: an SSRF in /player/timeline that accepts any X-Plex-Token value (CVE-2026-96652), unescaped identifiers in the loopback-only agent searchOne API that let an attacker call other plugins' functions (CVE-2026-96654), a transcoder path SSRF and owner-token exposure (CVE-2026-96655), and an admin file write through the TranscoderH264Options preference that drops a shared library into the Codecs folder, which Plex loads on the next transcode (CVE-2026-96656). Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. A public proof of concept was released on 2026-10-16, a honeypot recorded in-the-wild exploitation on 2026-10-17 delivering an XMRig-based miner and myawesomeproxy proxy software, Plex confirmed active and widespread exploitation on 2026-10-19, and CISA added all four CVEs to KEV on 2026-10-20.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Individual CVE scores are medium to high (CVSS 4.0 5.3, 6.9, 5.3, 8.6); the critical rating reflects Plex's statement that the chain gives unauthenticated code execution and is widely exploited. Published indicators come from one honeypot over a short window. The CVE record and Plex's summary describe CVE-2026-96655 differently (transcoder path SSRF vs owner admin token disclosure). Honeypot attacker and payload-host IP addresses are listed in the cited honeypot post and are omitted here.",
  "firstObservedAt": "2026-10-17T00:00:00Z",
  "lastObservedAt": "2026-10-19T20:17:01Z",
  "publishedAt": "2026-10-20T20:31:45.590Z",
  "reviewedAt": "2026-10-20T20:31:37.843Z",
  "expiresAt": "2026-10-19T20:17:01Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "plex-forum",
      "label": "Plex: Important Security Update for Plex Media Server v1.43.2 and earlier",
      "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-19T20:17:01Z"
    },
    {
      "id": "zmain",
      "label": "zmain: Plex2Shell, unauthenticated RCE in Plex Media Server",
      "url": "https://zmain.info/blog/plex2shell",
      "sourceType": "research",
      "observedAt": "2026-10-16T00:00:00Z"
    },
    {
      "id": "honeypot",
      "label": "boredhackerblog: Plex vulnerabilities being exploited in the wild",
      "url": "https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html",
      "sourceType": "research",
      "observedAt": "2026-10-17T00:00:00Z"
    },
    {
      "id": "kev",
      "label": "CISA Known Exploited Vulnerabilities catalog (2026.10.20)",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-20T19:00:31Z"
    },
    {
      "id": "csaf",
      "label": "CISA CSAF VA-26-266-01 Plex Media Server",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json",
      "sourceType": "government",
      "observedAt": "2026-09-23T15:39:29Z"
    },
    {
      "id": "cveorg",
      "label": "CVE.org record CVE-2026-96652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96652",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-19T20:17:01Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-96652",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-19T20:17:01Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: Plex2Shell operator write-up",
      "url": "https://hol.org/blog/cve-2026-96652-plex-media-server-plex2shell-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-10-19T20:17:01Z"
    }
  ],
  "artifacts": [
    {
      "id": "plex-media-server",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Plex Media Server",
      "version": "<1.43.3.10861",
      "defanged": false
    }
  ],
  "indicators": [
    {
      "id": "myawesomeproxy-sha256",
      "indicatorType": "file_hash",
      "value": "e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9",
      "defanged": false,
      "confidence": "medium"
    },
    {
      "id": "xmrig-sha256",
      "indicatorType": "file_hash",
      "value": "2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db",
      "defanged": false,
      "confidence": "medium"
    }
  ],
  "timeline": [
    {
      "id": "reported-to-plex",
      "occurredAt": "2026-07-27T00:00:00Z",
      "eventType": "other",
      "summary": "Researcher reports the chain to Plex security.",
      "sourceIds": [
        "zmain"
      ]
    },
    {
      "id": "plex-update-announced",
      "occurredAt": "2026-09-01T18:30:00Z",
      "eventType": "vendor_action",
      "summary": "Plex announces Plex Media Server 1.43.3 security update and asks all server owners to update.",
      "sourceIds": [
        "plex-forum"
      ]
    },
    {
      "id": "cve-publication",
      "occurredAt": "2026-09-23T15:39:29Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-96651 through -96656 published with CISA CSAF advisory VA-26-266-01; fixed in 1.43.3.10861.",
      "sourceIds": [
        "csaf",
        "cveorg"
      ]
    },
    {
      "id": "public-poc",
      "occurredAt": "2026-10-16T00:00:00Z",
      "eventType": "disclosure",
      "summary": "Plex2Shell write-up and proof-of-concept exploit published.",
      "sourceIds": [
        "zmain",
        "plex-forum"
      ]
    },
    {
      "id": "itw-honeypot",
      "occurredAt": "2026-10-17T00:00:00Z",
      "eventType": "first_observed",
      "summary": "Honeypot records in-the-wild exploitation dropping an XMRig-based miner, later myawesomeproxy.",
      "sourceIds": [
        "honeypot"
      ]
    },
    {
      "id": "plex-confirms-exploitation",
      "occurredAt": "2026-10-19T20:17:01Z",
      "eventType": "vendor_action",
      "summary": "Plex confirms active and widespread exploitation and publishes compromise checks.",
      "sourceIds": [
        "plex-forum"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-20T19:00:31Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-96652, -96654, -96655 and -96656 to KEV (catalog 2026.10.20); due 2026-10-23 for 96654/96656 and 2026-11-03 for 96652/96655; forensic triage flagged for 96656.",
      "sourceIds": [
        "kev"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Servers on 1.43.3.10861 or newer are not affected per Plex; prior exposure still needs the compromise checks",
    "The chain targets Plex Media Server, not Plex client apps",
    "Servers not reachable from the internet are outside the internet-wide attacks Plex describes, but a LAN attacker can still run the chain",
    "Not an attack on plex.tv or Plex cloud accounts",
    "Updating does not remove an existing miner, proxy, Codecs-folder library or attacker-set preference"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-96652-plex-media-server-plex2shell-kev/corrections"
}