Admin-Triggered Arbitrary File Write & RCE in Plex Media Server
CISA: Plex Media Server External Control of File Name or Path Vulnerability
CVE-2026-96656 is an arbitrary file write vulnerability in Plex Media Server versions prior to 1.43.3.10861. The flaw is triggered via the 'TranscoderH264Options' preference, which is appended verbatim to x264's command-line options, allowing an admin user to inject parameters. This can be combined with the server's behavior of loading all .so files at startup without signature, execute-bit, or symbol checks, potentially leading to remote code execution. The vulnerability is rated as high severity (CVSS 8.6) and requires administrative access to exploit. There are no known public exploits or active exploitation reports as of now.
What to do: Upgrade Plex Media Server to version 1.43.3.10861 or later immediately. Review the 'TranscoderH264Options' setting in your server configuration for any unexpected or suspicious content. Audit any custom .so files or shared libraries placed in the Plex installation directories.
| Plex Media Server | before 1.43.3.10861 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges. Plex Media Server is a popular media suite that helps users…
Ravie Lakshmanan Oct 21, 2026 Vulnerability / Malware The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell . The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex…
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)…
Ravie Lakshmanan Oct 19, 2026 Vulnerability / Web Security Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different…
Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public. The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code…
Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitation" if you just care about that part. It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about. I wouldn't be surprised if threat actors deploy more sophisticated things.…
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server. Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection. On October…
Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026. The activity follows the release of Plex2Shell, a public exploit that chains four vulnerabilities to run code without logging in. Later observations also revealed proxy software running alongside the miner. The findings…