Plex2Shell Exploited in the Wild: PoC Released for Unauthenticated Plex Media Server RCE Chain
Do Son 
TL;DR
Attackers began exploiting Plex Media Server vulnerabilities on October 17, 2026, one day after researcher Zach Main published full details and PoC code for his “Plex2Shell” chain. The chain links four CVEs into unauthenticated remote code execution. A honeypot caught attackers dropping a cryptominer and a proxy tool.
- Product: Plex Media Server
- Vulnerabilities: 4 flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)
- Highest severity: 8.6 (High · CVSSv4)
- Worst impact: arbitrary file write
- Status: Exploited in the wild
- Action: Update to 1.43.3.10861 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-96656 | 8.6 | arbitrary file write | 1.43.3.10861 | Exploited in the wild |
| CVE-2026-96654 | 6.9 | URL injection | 1.43.3.10861 | Exploited in the wild |
| CVE-2026-96652 | 5.3 | SSRF | 1.43.3.10861 | Exploited in the wild |
| CVE-2026-96655 | 5.3 | arbitrary-host SSRF | 1.43.3.10861 | Exploited in the wild |
Why It Matters
Many people run Plex at home, often on residential IP addresses. That makes hijacked servers useful as proxies. The researcher behind the BoredHackerBlog honeypot report warns that threat actors “would love to have residential IP proxy to access corporate VPNs and emails.”
How the Attack Works
Main’s Plex2Shell write-up describes a four-step chain. None of the individual CVEs scores above 7.2. Together, however, they need no valid login.
- CVE-2026-96652 (CVSS 4.3): SSRF in a player endpoint. It checks only that a token exists, not that it is valid.
- CVE-2026-96654 (CVSS 6.5): URL injection that reaches an internal plugin API.
- CVE-2026-96655 (CVSS 4.3): a second SSRF in the transcoder.
- CVE-2026-96656 (CVSS 7.2): an admin file write that the server later loads as code.
In short, the chain steals the owner’s admin token and then runs commands as the Plex service user.
Exploitation status
The flaws are now exploited in the wild. Public PoC code is available on GitHub, so attackers needed only a day to put it to use. On October 17, the honeypot recorded attacks from three IP addresses: 45.194.92.222, 91.92.40.202 and 176.65.139.228. Payloads came from 217.60.194.116 and included the XMRig miner. CISA has not yet added these Plex Media Server vulnerabilities to its KEV catalog.
Affected Versions
All four flaws affect Plex Media Server before 1.43.3.10861. Plex first warned users on September 1 about versions 1.43.2 and earlier.
Patch and Mitigation Steps
- Update Plex Media Server to 1.43.3.10861 or later.
- Avoid exposing port 32400 directly to the internet.
- Check hosts for unknown Docker containers, miners or proxy processes.
- Block the IP addresses listed above.
Main reported the bugs in July, and Plex fixed them weeks before public disclosure. Even so, many home servers never update on their own. With Plex Media Server vulnerabilities now exploited in the wild, owners should check their version today.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
