Plex2Shell Vulnerabilities Exploited to Deploy Miners and Proxy Malware

Summary

CISA added four Plex Media Server flaws to its KEV catalog after active exploitation enabled unauthenticated remote code execution. Attackers deployed cryptocurrency miners and proxy malware; upgrade to version 1.43.3.10861 or later.

Key points

CISA added the four Plex2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 21, 2026, after exploitation was observed.
The chain combines CVE-2026-96652, CVE-2026-96655, CVE-2026-96654, and CVE-2026-96656 to obtain an administrator token, write a malicious library, and execute code without valid credentials.
Plex Media Server versions earlier than 1.43.3.10861 are affected; fixes became available on August 3–4, 2026.
Exploitation requires network access to TCP port 32400 and, for the described proof of concept, an outbound connection from the server to an attacker-controlled host.
Observed payloads include cryptocurrency miners and proxy malware, which can route third-party traffic through a compromised server.
The Shadowserver Foundation reported more than 36,000 internet-accessible unpatched servers in early September 2026.
Upgrade to version 1.43.3.10861 or later and investigate exposed systems for malicious codec files, unexpected processes, proxy activity, or other signs of compromise.

Article Details

Vulnerability Types: Server-side request forgery
URL injection
Arbitrary file write
Severity: The complete exploit chain has a CVSS score of 9.8; the individual vulnerabilities range from medium to high severity.
Affected Versions: Plex Media Server versions earlier than 1.43.3.10861
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available