{"type":"bundle","id":"bundle--be0d2ce0-fa1e-5dea-90f8-29cc635996a1","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--39ff149d-15bd-5e9d-9fa8-625ca83b1824","created":"2026-10-20T20:31:45.590Z","modified":"2026-10-20T20:31:45.590Z","name":"Plex Media Server hijacked without a login through the Plex2Shell chain, on CISA KEV (CVE-2026-96652)","description":"Plex2Shell chains four Plex Media Server bugs fixed in 1.43.3.10861: an SSRF in /player/timeline that accepts any X-Plex-Token value (CVE-2026-96652), unescaped identifiers in the loopback-only agent searchOne API that let an attacker call other plugins' functions (CVE-2026-96654), a transcoder path SSRF and owner-token exposure (CVE-2026-96655), and an admin file write through the TranscoderH264Options preference that drops a shared library into the Codecs folder, which Plex loads on the next transcode (CVE-2026-96656). Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. A public proof of concept was released on 2026-10-16, a honeypot recorded in-the-wild exploitation on 2026-10-17 delivering an XMRig-based miner and myawesomeproxy proxy software, Plex confirmed active and widespread exploitation on 2026-10-19, and CISA added all four CVEs to KEV on 2026-10-20.","aliases":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656","Plex2Shell","Plex Media Server RCE chain","Plex cryptominer"],"first_seen":"2026-10-17T00:00:00Z","last_seen":"2026-10-19T20:17:01Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Plex: Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"},{"source_name":"zmain: Plex2Shell, unauthenticated RCE in Plex Media Server","url":"https://zmain.info/blog/plex2shell"},{"source_name":"boredhackerblog: Plex vulnerabilities being exploited in the wild","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"},{"source_name":"CISA Known Exploited Vulnerabilities catalog (2026.10.20)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"CISA CSAF VA-26-266-01 Plex Media Server","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"source_name":"CVE.org record CVE-2026-96652","url":"https://www.cve.org/CVERecord?id=CVE-2026-96652"},{"source_name":"NVD CVE-2026-96652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652"},{"source_name":"HOL blog: Plex2Shell operator write-up","url":"https://hol.org/blog/cve-2026-96652-plex-media-server-plex2shell-kev"}]}]}