Cybersecurity Research & Engineering

Security Research

CISA Alerts on Active Exploitation of Plex2Shell Vulnerabilities in Plex Media Server

CISA warns of active exploitation of four chained vulnerabilities in Plex Media Server, collectively known as Plex2Shell, enabling attackers to gain admin tokens and execute code with elevated privileges. Immediate patching is advised.

CSLabs ·

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of four vulnerabilities in Plex Media Server, collectively termed Plex2Shell. When chained, these flaws allow attackers to obtain administrative tokens and execute arbitrary code with elevated privileges.

Technical Context

Plex Media Server is widely used for organizing and streaming personal media collections. The Plex2Shell vulnerabilities affect versions prior to 1.43.3.10861, released on August 4, 2026. The individual flaws include:

  • CVE-2026-96652: An unauthenticated server-side request forgery (SSRF) vulnerability in the /player/timeline endpoint, enabling attackers to make Plex send POST requests to arbitrary destinations, including internal APIs.
  • CVE-2026-96654: A URL injection vulnerability in the searchOne function, allowing invocation of other plugins with attacker-controlled parameters.
  • CVE-2026-96655: An authenticated SSRF flaw in the transcoder endpoint permitting requests to arbitrary internal or external addresses.
  • CVE-2026-96656: An arbitrary file write vulnerability in transcoder settings that allows planting malicious shared libraries, leading to code execution.

The combined exploit chain has been assigned a critical severity score of 9.8 by the original researcher.

Security Impact

Exploitation of these vulnerabilities enables attackers to escalate privileges and execute arbitrary code on affected Plex Media Servers. Initial exploitation reports indicate use in deploying cryptominers on compromised systems.

CSLabs Analysis

The Plex2Shell vulnerabilities demonstrate the risk of chaining multiple medium-to-high severity flaws to achieve critical impact. The presence of SSRF and arbitrary file write vulnerabilities in a widely deployed media server underscores the need for comprehensive security assessments of complex software components.

Defensive Considerations

  • Administrators should prioritize patching Plex Media Server to version 1.43.3.10861 or later to mitigate these vulnerabilities.
  • Where immediate patching is not feasible, applying recommended mitigations and restricting network access to the Plex server can reduce exposure.
  • Monitoring for unusual outbound requests from Plex servers may help detect exploitation attempts leveraging SSRF flaws.

All articles