Plex2Shell: how four Plex flaws add up to a 9.8

On October 20, CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.³ Together they form Plex2Shell, a chain that researcher Zach Main rates 9.8 on CVSS and that takes an attacker from the internet to code execution on the server with no authentication.¹ Taken one by one, the flaws are rated medium to high severity: 5.3, 5.3, 6.9 and 8.6 on CVSS.²⁵

The fix has been available since August 4, in version 1.43.3.10861.² Earlier servers remain vulnerable.

The chain, step by step

Main describes five stages, each resting on an assumption of trust that doesn't hold up.¹

1. Unauthenticated SSRFServer-side request forgery: the attacker makes the server itself send a request they couldn't send from outside. in /player/timeline. The token check only tests whether the X-Plex-Token parameter exists, not whether it's valid. An unvalidated protocol value in a subscription's callback URL makes the server send a blind POST to its own loopbackThe 127.0.0.1 address, through which a machine talks to itself; many services treat that traffic as trusted. address.
2. Pivot to /system/agents/*. This API family skips token checks on loopback. An @lock decorator discards the value returned by the inner check, so the identifier guard in agentservice.py doesn't stop the call to searchOne. The identifier also goes into the URL unencoded, so characters like ? and # can alter the request.
3. Owner token theft. The plugin framework attaches the owner's token to any outbound request whose URL starts with http://127.0.0.1. The comparison is a plain prefix match, and a lookalike hostname satisfies it. The target is the TheTVDB agent's GetResultFromNetwork function.
4. Payload delivery. With the token, the attacker sets the TranscoderH264Options preference through /:/prefs. It passes the dump-yuv option to x264, which writes decoded frames to a path of the attacker's choice inside the codecs directory. A request to the /video/:/transcode/universal endpoint then makes the server fetch and transcode an attacker-hosted video whose first frame carries a .so library, byte for byte.
5. Execution. On the next transcode, the bundled libavutil.so.58 calls dlopen on every .so file in that directory, without validating name or signature. A constructor in the written file runs as the plex user.

Why the sum exceeds any part

BleepingComputer describes the four CVEs as an unauthenticated SSRF in /player/timeline, a URL injection in searchOne, an authenticated SSRF in the transcoder endpoint, and an arbitrary file write in the transcoder settings, the last of which requires an administrator account.² Alone, the last three need access the attacker doesn't have. The first opens the door, and the rest of the chain manufactures what's missing: loopback traffic needs no token, the owner's token leaks through a string prefix, and the written file becomes code.

Two design decisions show up repeatedly. Traffic from 127.0.0.1 is treated as trusted, even though an SSRF makes any request look local. And a URL is accepted because it begins with certain text, even though the start of a string doesn't say who the recipient is.

Timeline and exploitation

Main reported the flaws to Plex on July 27. The company acknowledged them and paid a bounty on August 4, CVEs were assigned on September 23, and the technical write-up was published on October 16.¹ Field Effect says the proof-of-concept exploit went up on GitHub alongside the write-up.⁵

The first attacks seen in the wild date from October 17. The operator of a honeypot running a vulnerable Plex version logged exploitation that morning and, later the same day, downloads of the XMRig miner and a proxy tool.⁴ Field Effect reports the same payload profile: cryptocurrency miners and proxy malware.⁵

CISA's catalog lists all four flaws as added on October 20. Deadlines differ: October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for CVE-2026-96652 and CVE-2026-96655.³ BleepingComputer, which published on October 21, cites the October 23 deadline for federal agencies.²

Home servers and manual updates

The Shadowserver Foundation counted more than 36,000 unpatched Plex Media Server instances reachable from the internet in early September.⁵ Field Effect recommends checking the installed version in Plex's management interface, especially on NAS boxes and other devices that don't update themselves, and inventorying every server, VM and remote environment.⁵

Anyone who was exposed on a vulnerable version needs to do more than update. Field Effect lists unexpected files in the codecs directory, new processes launched by the Plex service, sustained high CPU use and unusual outbound connections as signs of compromise, and notes that a server can stay compromised after patching if attackers got there first. For machines that were exposed while running a vulnerable version, it recommends a forensic review.⁵

Sources

1. Plex2Shell · Zach Main · zmain.info · https://zmain.info/blog/plex2shell · Oct. 2026
2. CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers · Bill Toulas · BleepingComputer · https://bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers · Oct. 21, 2026

Show 3 more sourcesHide sources

3. Known Exploited Vulnerabilities Catalog · CISA · https://www.cisa.gov/known-exploited-vulnerabilities-catalog · accessed Oct. 29, 2026
4. Plex vulnerabilities being exploited in the wild · Bored Hacker Blog · http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html · Oct. 17, 2026
5. Active exploitation of Plex2Shell vulnerabilities · Field Effect · https://fieldeffect.com/blog/active-exploitation-plex2shell-vulnerabilities · Oct. 2026