The Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities affecting Plex Media Server to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. The flaws can be chained together in an attack sequence known as “Plex2Shell,” which allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable media servers.
The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, were identified by security researcher Zach Main. While Plex has released updates to address these issues, the public release of a proof-of-concept (PoC) exploit on October 16, 2026, triggered immediate activity from threat actors targeting internet-exposed servers.
How the Plex2Shell Attack Works
The “Plex2Shell” exploit chain utilizes a combination of Server-Side Request Forgery (SSRF) and path traversal vulnerabilities. By chaining these flaws, an attacker can bypass the standard authentication requirements of the Plex Media Server. Once access is gained, the attacker can leverage further vulnerabilities within the server’s handling of internal requests to execute arbitrary commands at the system level.
Because Plex Media Server is often installed with high privileges to manage large media libraries across various file systems, a successful RCE attack can grant the intruder full control over the underlying host machine. This is particularly concerning for home users who may have their Plex server connected to network-attached storage (NAS) devices containing sensitive personal data.
Malware Payloads: Miners and Proxies
Reports from security researchers, including observations of honeypots, indicate that attackers are primarily using the Plex2Shell chain to monetize compromised hardware. Two specific types of malware are currently being deployed in the wild:
- XMRig Cryptocurrency Miner: This software hijacks the server’s CPU resources to mine Monero. Users may notice a significant drop in server performance, sluggish media playback, or increased electricity costs and hardware temperatures.
- “myawesomeproxy” Residential Proxy: This payload turns the compromised server into a residential exit node. Attackers resell this bandwidth to third parties who use the victim’s home IP address to mask their own activities. This can lead to the user’s IP being blacklisted by websites or flagged for suspicious behavior they did not commit.
Remediation and Deadlines
Plex has confirmed that the vulnerabilities are resolved in Plex Media Server version 1.43.3.10861 and all subsequent releases. Administrators of both home and enterprise servers should verify their current version and update immediately if they are running an older build. Servers that are directly exposed to the internet via port forwarding are at the highest risk.
The inclusion of these flaws in the CISA KEV catalog mandates that federal agencies prioritize their remediation. CISA has set a strict deadline of October 23, 2026, for agencies to patch the most critical components of the chain, specifically CVE-2026-96656 and CVE-2026-96654. The remaining vulnerabilities in the catalog must be addressed by November 3, 2026.
Beyond updating the software, security experts recommend disabling “Remote Access” in the Plex settings if it is not strictly necessary, or utilizing a VPN to access the server remotely rather than exposing the Plex port (typically 32400) directly to the public internet.
