Article
Plex2Shell: Four Plex Media Server CVEs Chained Into Remote Code Execution
Plex2Shell chains four Plex Media Server CVEs into remote code execution. CISA lists all four as exploited. See the fixed version and what to…
Read more
Exploited vulnerability
Plex Media Server searchOne URL injection (CVE-2026-96654)
An improper neutralization of encoded URI schemes (CWE-84) in Plex Media Server before build 1.43.3.10861.
- On CISA KEV
- CVE ID
- CVE-2026-96654
- CVSS
- 6.5 Medium (CVSS v3.1) and 6.9 Medium (CVSS v4.0), as scored by CISA in the CVE record; no privileges required
- CISA KEV
- Listed
- Affected product
- Plex Media Server (self-hosted: Windows, macOS, Linux, NAS and Docker)
- Exploited
- October 2026
- Published
- 23 September 2026
In short
CVE-2026-96654 is an improper neutralization of encoded URI schemes (CWE-84) in Plex Media Server before build 1.43.3.10861. The CVE record says URL values in searchOne are not handled correctly, so an attacker can call other plugins' functions and supply their own parameters. Plex describes it as access to internal agent functions over the loopback interface. CISA added it to its Known Exploited Vulnerabilities catalog on 20 October 2026.
- CVECVE-2026-96654
- ProductPlex Plex Media Server (self-hosted: Windows, macOS, Linux, NAS and Docker)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedCheck your version · Update now
What it allows
The CVE record says Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne. This allows an attacker to call other plugins' functions and supply their own parameters. Unlike its neighbours in the chain, the flaw needs no privileges in the CVSS vector.
The researcher explains the setting. The plugin management API under /system/agents/ needs no token for requests from the loopback address, so the forged request from CVE-2026-96652 reaches it.
A check meant to reject unknown identifiers does not stop anything, because a decorator discards its return value. The identifier is then placed into an internal URL without encoding, so the characters ? and # let an attacker forge calls to any plugin function.
In the researcher's chain, one forged call asks the server to fetch an address that begins with 127.0.0.1. The server then attaches the owner's admin token to the request. Plex's own table lists this CVE as access to internal agent functions over the loopback interface.
Plex2Shell is the name for the chain of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. CISA's entry for each one says it can be chained with the other three. Our Plex2Shell attack chain explainer shows the step before and after this one.
In our checks on 23 October 2026, a GitHub search for this CVE id returned 3 repositories, the earliest created on 17 October. We did not run or link any of them.
Who is affected
Plex Media Server before build 1.43.3.10861, according to the CVE record. Plex says 1.43.3.10861 and later are not affected.
Plex's post title says 1.43.2 and earlier, while its 19 October update gives the build number as the cutoff. Use the build number. The researcher's README names builds up to 1.43.3.10828 as vulnerable, so an early 1.43.3 build can still be affected.
Plex's update guide covers Windows, macOS, Linux, NAS devices and Docker. Plex says an internet-reachable server older than 1.43.3.10861 should be assumed possibly compromised.
Timeline
- 1 Sep 2026
Plex announces Plex Media Server 1.43.3 as a security release and says CVEs have been requested.
- 23 Sep 2026
The CVE record is published, with CISA as the CVE numbering authority.
- 16 Oct 2026
A public proof of concept is released, according to Plex.
- 19 Oct 2026
Plex publishes the CVE details and says the flaws are being actively and widely exploited.
- 20 Oct 2026
CISA adds the CVE to the Known Exploited Vulnerabilities catalog.
- 23 Oct 2026
The CISA due date for US federal agencies.
What to do
-
Check your version
Open Plex Web, go to Settings, then General, and read the version. Anything older than 1.43.3.10861 is affected. Compare all four numbers of the build, not only 1.43.3.
-
Update now
Install Plex Media Server 1.43.3.10861 or later. On a NAS the package manager may be behind, so Plex says to download the package from its Downloads page and install it by hand.
-
Cut exposure
If you do not need remote access, turn it off under Settings, then Remote Access. Plex also advises against forwarding port 32400 directly unless you need it.
-
Do not probe the agent paths
Do not send requests to /system/agents/ paths to test a server. Read the version in Plex Web. If you find any sign of compromise, remember that the chain can end with the owner's admin token stolen, so sign out of all devices and change your Plex password.
-
Rebuild if you cannot rule out a compromise
Plex advises a clean installation instead of reusing the old data directory. Sign out of all devices in your Plex account, change the password, and treat anything the Plex service account could reach as exposed.
Questions
Is CVE-2026-96654 being exploited?
Plex says the flaws in this chain are being actively and widely exploited, and CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on 20 October 2026. CISA lists use in ransomware campaigns as unknown.
Which Plex Media Server version fixes it?
Plex Media Server 1.43.3.10861 and later. Check Settings, then General, in Plex Web, and compare all four numbers of the build.
Do I need to turn off remote access?
Plex advises turning off Remote Access if you do not need it and not forwarding port 32400 directly unless you need it. Updating is still required.
What are plugin functions in Plex Media Server?
Plex Media Server runs metadata and agent code as plugins. The CVE record says this flaw lets an attacker call other plugins' functions and choose their own parameters.
Why does it need CVE-2026-96652?
The researcher says the plugin API opens without a token only for requests from the server itself. The request forgery in CVE-2026-96652 makes an outside request look like one from the server.
In our research
- Plex2Shell: Four Plex Media Server CVEs Chained Into Remote Code Execution October 2026
- PHP2Shell: Two Critical PHP Flaws Reported as RCE, CVE-2026-109618 and CVE-2026-109619 October 2026
- Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead) July 2026
- From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs? July 2026
Sources
- Important security update for Plex Media Server v1.43.2 and earlier Plex
- Known Exploited Vulnerabilities catalog CISA
- CVE-2026-96654 CVE Program
- CVE-2026-96654 NVD
- CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page MITRE
- Plex2Shell: Unauthenticated RCE in Plex Media Server zmain.info (researcher)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 64 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 108 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.