Security Intelligence
Loading table of contents...
Loading table of contents...
At a glance:
-
On October 21, 2026, CISA added the four vulnerabilities that make up the Plex2Shell exploit chain to its Known Exploited Vulnerabilities (KEV) catalog after active exploitation was observed.
-
Threat actors are using the exploit chain to gain remote code execution on vulnerable Plex Media Server deployments and have been observed deploying cryptocurrency miners and proxy malware.
-
Plex Media Server versions prior to 1.43.3.10861 are affected. Fixes became available on August 3-4, 2026, but more than 36,000 internet-exposed servers remained vulnerable in September.
Threat summary
On October 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four Plex Media Server vulnerabilities to the KEV catalog. This came shortly after Plex updated its security advisory with CVE details, confirming exploitation and providing indicators of compromise.
On October 16, researcher published the Plex2Shell write-up together with the proof of concept (PoC) on GitHub. The first in-the-wild exploitation using the POC was recorded the day after.
Plex Media Server is a self-hosted media streaming platform that allows users to manage and stream content across local and remote devices. It listens on Transmission Control Protocol (TCP) port 32400 and is commonly exposed to the internet through its Remote Access feature or manual port forwarding to support media streaming and management functions. The server exposes multiple web-facing APIs, performs requests to internal services, and loads codec libraries used for media processing.
The Plex2Shell attack chain abuses those legitimate functions to move from unauthenticated access to code execution. The chain combines four vulnerabilities:
- CVE-2026-96652 (CVSS 5.3), a server-side request forgery vulnerability
- CVE-2026-96655 (CVSS 5.3), also a server-side request forgery vulnerability
- CVE-2026-96654 (CVSS 6.9), a URL injection vulnerability
- CVE-2026-96656 (CVSS 8.6), an arbitrary file write vulnerability
Chained together, these flaws allow a remote adversary to obtain an administrator token, force the server to retrieve attacker-controlled content, write a malicious shared library into the Plex Codecs directory, and execute code without valid credentials.
Exploitation requires network access to TCP port 32400, which Remote Access or port forwarding extends to the internet; servers reachable only internally remain exploitable from the same network. The PoC also requires the PMS host to connect outbound to an adversary-controlled host to fetch the carrier video and return a reverse shell.
The individual flaws range from medium to high severity, but the complete exploit chain has a CVSS score of 9.8. Internet exposure of a vulnerable Plex Media Server is a key requirement for exploitation.
Observed activity has included compromise of vulnerable Plex systems to deploy cryptocurrency miners and proxy malware. Proxy malware is particularly notable because it allows a compromised server to relay third-party traffic through the victim environment, giving threat actors access to residential and enterprise network addresses that can be reused in follow-on operations.
Analysis
Because Plex Media Server (PMS) is commonly exposed to the internet, it's an attractive target for threat actors seeking remotely accessible systems. The highest-risk deployments are internet-facing PMS instances running versions earlier than 1.43.3.10861, particularly those with TCP port 32400 exposed to the internet. Because the Plex2Shell exploit chain does not require authentication or user interaction, exposed servers can be targeted directly.
The Shadowserver Foundation reported more than 36,000 internet-accessible, unpatched PMS instances in early September 2026, several weeks after security updates became available. PMS deployments are frequently hosted on network-attached storage (NAS) devices, home-office systems, small-office infrastructure, and virtual machines that may fall outside standard asset inventories, patch management programs, and security monitoring.
The observed payloads provide insight into threat actor objectives. Cryptocurrency mining converts host resources into revenue, while proxy software routes third-party traffic through the compromised system. This allows adversary activity to originate from the victim's internet connection rather than attacker-controlled infrastructure, making activity more difficult to attribute and potentially increasing the reputation of malicious traffic.
While researchers demonstrated remote code execution as the PMS service account, further impact depends on the permissions assigned to the PMS service account and the resources accessible from the host. A compromised PMS server with access to file shares, backups, management interfaces, or other internal services could expose those resources to unauthorized access or modification. In business environments, a compromised PMS system may also provide a foothold within a trusted network segment, creating opportunities for follow-on activity.
The updated Plex advisory and indicators of compromise suggest that affected systems may remain compromised even after patching if malicious files or processes were deployed before updates were applied. Unauthorized libraries placed in Plex codec directories, mining processes, proxy software, modified transcoder settings, and exposed administrative tokens may require additional investigation and remediation beyond installing the latest version.
Mitigations
Upgrade Plex Media Server deployments to version 1.43.3.10861 or later to remove exposure to the vulnerabilities used in the Plex2Shell attack chain. Verify the installed version through the Plex management interface, particularly on NAS platforms and other deployments that do not receive automatic updates.
Identify PMS deployments across servers, NAS devices, virtual machines, and remote-user environments. Review internet-facing systems for indicators of compromise, including unexpected files within Plex codec directories, new processes launched by the PMS service, sustained CPU utilization associated with cryptocurrency mining, and unusual outbound network connections linked to proxy activity.
Systems that were exposed to the internet while running vulnerable versions warrant forensic review to determine whether exploitation occurred prior to patching. Researchers have also released detection rules and packet captures that can support threat hunting and detection development.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
