Plex2Shell attacks are targeting Plex Media Server through a chain of four vulnerabilities, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Together, the flaws allow attackers to obtain the server owner’s administrator token and execute code with elevated privileges.
CISA has directed federal agencies to patch affected systems or apply mitigations by October 23. Meanwhile, reports of exploitation describe attackers deploying cryptocurrency-mining malware.
Four Vulnerabilities Combine Into a Critical Exploit Chain
Plex Media Server lets users organize movies, television shows, music and photos. It also supports streaming across local networks and remotely over the internet.
Security researcher Zach Main discovered the vulnerabilities and reported them to Plex on July 27. Although the individual flaws carry medium or high severity ratings, Main assigns the combined exploit chain a critical score of 9.8.
The chain involves four security weaknesses:
- CVE-2026-96652: A server-side request forgery flaw in
/player/timelinelets unauthenticated attackers trigger POST requests to arbitrary destinations, including internal Plex APIs. - CVE-2026-96654: A URL injection flaw in
searchOneallows attackers to invoke other plugins’ functions with parameters they control. - CVE-2026-96655: An authenticated server-side request forgery flaw in the transcoder endpoint permits requests to arbitrary internal or external addresses.
- CVE-2026-96656: An arbitrary file write flaw in transcoder settings lets administrators plant malicious shared libraries that Plex subsequently loads, enabling code execution.
Together, these weaknesses create a route from unauthorized requests to administrator access and code execution.
Plex2Shell Attacks Follow Public Technical Disclosure
Main published technical details of the vulnerabilities on October 16. Reports of active exploitation then emerged on October 17, before the researcher released a proof-of-concept exploit on October 19.
The early reports described attacks against Plex honeypots that attempted to deploy a cryptominer. These decoy systems help researchers observe malicious activity.
However, those observations do not establish the total number of compromised Plex servers. CISA’s warning confirms active exploitation without providing a victim count in the supplied account.
Patched Plex Release Has Been Available Since August
Plex2Shell affects Plex Media Server versions earlier than 1.43.3.10861. Plex released that version on August 4, following the researcher’s private disclosure.
Administrators should therefore check their installed version and upgrade affected servers to a patched release.
The October 23 deadline applies to federal agencies covered by CISA’s directive. Nevertheless, the exploitation reports also give other Plex administrators a clear reason to prioritize updates.
Siemens Software Center Also Faces Active Exploitation
Alongside the Plex vulnerabilities, CISA added a Siemens Software Center flaw to its Known Exploited Vulnerabilities catalog.
Tracked as CVE-2026-110936, the vulnerability involves an uncontrolled search path element. Siemens warned on October 19 that attackers were exploiting it in campaigns linked to Romulus, a platform for delivering multiple payloads through ClickFix attacks.
However, researchers have not established Romulus’s operating model. Possible explanations include a private platform, a criminal delivery service, an affiliate framework or software shared between operators.
Siemens has published indicators of compromise and guidance for identifying affected systems. It also urges administrators to install Siemens Software Center 4.0.9.8 or later.
SiteGuard Command Injection Flaw Joins CISA Catalog
CISA also added CVE-2026-106931, an operating system command injection vulnerability affecting SiteGuard Server Edition.
Both the vendor and Japan’s CERT had flagged active exploitation before the catalog addition.
The vendor recommends version 8.00 Update 5 or later for SiteGuard Server Edition on Apache httpd, Nginx and IIS. For Apache httpd and Nginx on FreeBSD, administrators should install version 7.00 Update 6 or later.
These additions highlight active attacks against several different server products. Administrators should check each affected application and apply the relevant vendor updates.
0 responses to “Plex2Shell Attacks Exploit Four Plex Media Server Flaws”