CISA lists four exploited Plex2Shell flaws in KEV
First merged summary.
CISA added four exploited Plex Media Server flaws to KEV, with federal fix deadlines of October 23 and November 3.
CISA on October 20 listed four exploited Plex Media Server bugs, dubbed Plex2Shell, in the Known Exploited Vulnerabilities catalog. Versions before 1.43.3.10861 are affected; The Hacker News dates that fix to August 3, 2026, while BleepingComputer dates it to August 4. BleepingComputer reports one October 23 deadline; CISA sets October 23 for CVE-2026-96654 and CVE-2026-96656 and November 3 for the SSRF flaws. BleepingComputer says Zach Main published details October 16 and a proof of concept October 19, with honeypot cryptominer activity from October 17. The Hacker News says the bugs chain into unauthenticated remote code execution used for miners and proxy malware; BleepingComputer says attackers obtain an admin token and run elevated code.
- Affected builds are Plex Media Server versions before 1.43.3.10861.
- CVE-2026-96652 lets any X-Plex-Token POST via /player/timeline.
- CVE-2026-96655 is authenticated SSRF on /video/:/transcode/universal.
- CVE-2026-96654 mishandles searchOne URLs and can call plugin functions.
- CVE-2026-96656 lets admins write .so files loaded without checks.
- Agencies must apply vendor mitigations under BOD 26-04 or stop use.
Timeline
dated events in the reporting · oldest first- Aug 3, 2026Plex Media Server 1.43.3.10861 fix reported released · The Hacker News
- Aug 4, 2026Same fixed release dated August 4 · BleepingComputer
- Oct 16, 2026Zach Main published details of the Plex flaws · BleepingComputer
- Oct 17, 2026Honeypot exploitation and cryptominer deployment reported · BleepingComputer
- Oct 19, 2026Proof of concept published three days later · BleepingComputer
- Oct 20, 2026CISA added the four Plex flaws to KEV · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- CISA Known Exploited VulnerabilitiesEndpoint parameters, plugin and .so mechanisms, and split due dates
- The Hacker NewsCVSS scores, unauthenticated RCE chain, miners and proxy malware
- BleepingComputerResearcher disclosure dates, honeypot cryptominer, August 4 fix date
Coverage
oldest first · one row per article · UTC- · 11d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA lists exploited Plex Media Server SSRF (CVE-2026-96655)
Authenticated users on builds before 1.43.3.10861 can request arbitrary addresses; the KEV due date is November 3.
- · 11d ago
CISA lists Plex plugin-call flaw in KEV (CVE-2026-96654)
Plex Media Server before 1.43.3.10861 can let an attacker invoke other plugins’ functions; agencies have until October 23.
- · 11d ago
CISA adds Plex arbitrary file-write flaw to KEV (CVE-2026-96656)
An admin can write files that load as unsigned .so modules on Plex before 1.43.3.10861; due date is October 23.
- · 11d ago
CISA adds Plex Media Server SSRF to KEV (CVE-2026-96652)
Any X-Plex-Token can force a POST via /player/timeline on builds before 1.43.3.10861; the due date is November 3.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106931 | OS command injection in SiteGuard Server Edition | 8.5 | 3% | KEV | KEV |
| CVE-2026-110936 | DLL Search-Path Hijacking in Siemens Software Center | 8.4 | <1% | KEV | KEV |
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |