CISA Warns of Actively Exploited Plex Flaws in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency is urging federal agencies to patch Plex2Shell vulnerabilities following active exploitation in the wild.
Radwan AbdulhadiEditor and technology writer
Plex2Shell Attack Chain Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges.
Plex Media Server is a popular media suite that helps users organize personal collections of movies, TV shows, music, and photos, and stream them to other devices at home or remotely over the internet. CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23.
Discovery and Vulnerability Breakdown
The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27. The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8. You can read full technical details for the Plex2Shell vulnerability chain on the researcher's blog.
The individual components of the Plex2Shell chain include CVE-2026-96652, an SSRF flaw in /player/timeline that allows unauthenticated attackers to make Plex send POST requests to arbitrary destinations including internal APIs. Another issue is CVE-2026-96654, a URL injection flaw in searchOne allowing attackers to invoke other plugins' functions with attacker-controlled parameters. Additionally, CVE-2026-96655 is an authenticated SSRF flaw in the transcoder endpoint, and CVE-2026-96656 is an arbitrary file write flaw in transcoder settings allowing administrators to plant malicious shared libraries that lead to code execution.
Exploitation in the Wild
Zach Main published full technical details for the Plex2Shell vulnerabilities on October 16, followed by a proof-of-concept (PoC) exploit three days later. On October 17, reports of Plex2Shell being exploited in the wild started to emerge, initially targeting Plex honeypots to deploy a cryptominer. Further documentation regarding these incidents shows that vulnerabilities were actively exploited in the wild soon after disclosure.
Plex2Shell impacts Plex Media Server versions before 1.43.3.10861, which was released on August 4 according to official update communications.
Additions to CISA KEV Catalog
Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities (KEV) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC). The German technology giant warned that hackers were leveraging the vulnerability in campaigns linked to a multi-payload ClickFix delivery platform called Romulus.
Forescout notes that the Romulus platform may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software copied between operators. Siemens's alert shares indicators of compromise and advises administrators to update Siemens Software Center to version 4.0.9.8 or later.
Additional WAF Flaws and Defense Metrics
CISA has also added CVE-2026-106931 to KEV, an OS command injection flaw affecting the SiteGuard Server Edition web application firewall (WAF). Both the vendor and Japan's CERT flagged CVE-2026-106931 as actively exploited late last week.
Security industry reports emphasize that prevention scores can hide what happens after initial access. Data shows that once attackers have valid credentials, only 37% of their actions are blocked across monitored enterprise environments.
Sources
- BleepingComputerCISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Continue chronologically
Related stories
Siemens Software Center Vulnerability Exploited in ClickFix Attacks
Siemens reveals active exploitation of a DLL side-loading vulnerability in its Software Center linked to the Romulus ClickFix malware delivery campaign.
CISA Warns SharePoint, WSO2, Adobe Flaws Exploited
CISA has issued warnings regarding actively exploited vulnerabilities affecting WSO2, Adobe Commerce, Microsoft SharePoint, and Mikrotik RouterOS.
CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks
CISA has added the Node2Shell Brotli vulnerability to its KEV catalog as security firms record initial exploitation attempts and major vendors issue patches.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
