Plex2Shell is a chain of four Plex Media Server flaws that lets an attacker with no account run code on the server. Plex says it is being exploited widely, and CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on 20 October 2026. Update to build 1.43.3.10861 or later. A server older than that and reachable from the internet may already be compromised.
Last updated: 23 October 2026.
We update this post when Plex, CISA or the researcher who found the flaws publish new facts.
Plex Media Server is software that people run at home, on a NAS or in a container to stream their own media. Plex tells owners to avoid forwarding port 32400 directly unless they need it. Servers reachable from the internet are the ones under attack.
Is My Plex Server Affected?
Plex Media Server before build 1.43.3.10861 is affected, according to the CVE record of each flaw. Plex says 1.43.3.10861 and later are not affected. The title of Plex’s post says 1.43.2 and earlier, but its 19 October update gives the build number as the cutoff.
Compare all four numbers of the build, not only 1.43.3. Plex announced 1.43.3 on 1 September, and the researcher’s README names builds up to 1.43.3.10828 as vulnerable. An early 1.43.3 build can therefore still be affected.
To read your version, open Plex Web, go to Settings, then General. That is the check Plex names itself.
What Are the Four CVEs?
| CVE | What the CVE record says | CVSS 3.1 | CISA due date |
|---|---|---|---|
| CVE-2026-96652 | Server-side request forgery in /player/timeline. Any X-Plex-Token value lets an attacker make the server POST to a URL they choose. | 4.3 | 3 November |
| CVE-2026-96654 | URL values in searchOne are not neutralized, so an attacker can call other plugins’ functions with their own parameters. | 6.5 | 23 October |
| CVE-2026-96655 | Request forgery for an authenticated user through the path parameter of /video/:/transcode/universal. | 4.3 | 3 November |
| CVE-2026-96656 | An admin can write files that may be run on load. The TranscoderH264Options preference is appended verbatim to the x264 options on every transcode. | 7.2 | 23 October |
Each score looks modest alone. The researcher who found the flaws rates the whole chain CVSS 3.1 9.8, with no privileges needed.
How Do the Four CVEs Chain Together?
CISA’s catalog entry for each CVE says it can be chained with the other three. The researcher’s write-up shows how. Each step gives the attacker what the next one needs, and the last step ends in code execution.
- CVE-2026-96652/player/timeline takes any token value; the server POSTs to a URL the attacker picks
- CVE-2026-96654searchOne passes URL values on unchecked, so the attacker calls other plugins’ functions
- Owner tokenThe write-up describes the server owner’s admin token being stolen at this point
- CVE-2026-96655The transcode path can be pointed at any internal or external address
- CVE-2026-96656A preference writes a file; unsigned .so files are then run as the Plex process
Sources word the middle steps differently. Plex’s table lists CVE-2026-96654 as access to internal agent functions over the loopback interface, while the CVE record describes URL values in searchOne that are not neutralized. Plex’s table lists CVE-2026-96655 as disclosure of the owner’s admin token, while the CVE record describes a request forgery through the transcode path. We follow the CVE records for what each CVE is and the researcher for the order of steps.
The researcher says the code runs with the rights of the Plex user. Our remote code execution entry explains this class of flaw.
Is Plex2Shell Being Exploited?
Yes, according to Plex. Its 19 October update says the flaws are being actively and widely exploited, and that attacks hit internet-facing servers that have not been updated. Plex says compromised servers ran cryptocurrency miners and proxy software that routes other people’s traffic through the victim’s connection.
CISA added all four CVEs to the Known Exploited Vulnerabilities catalog on 20 October. It lists use in ransomware campaigns as unknown. The federal due date is 23 October for CVE-2026-96654 and CVE-2026-96656, and 3 November for the other two. CISA also marks CVE-2026-96656 as needing forensic triage.
Plex says a public proof of concept came out on 16 October. The researcher’s own timeline says the flaws were reported to Plex on 27 July, acknowledged on 4 August and given CVE numbers on 23 September.
What Should You Do Now?
- Update Plex Media ServerInstall 1.43.3.10861 or later. On a NAS, install the package by hand if the package manager is behind.
- Confirm the versionOpen Plex Web, then Settings, then General.
- Turn off Remote Access if you do not need itSettings, then Remote Access. Do not forward port 32400 directly.
- Check for signs of compromiseUse the list in the section below.
- Rebuild if you cannot rule it outUse a clean installation, not the old Plex data directory.
Plex’s original post shows Linux install commands with a package name for version 1.19.4.2935. That does not match 1.43.3, so use the file name of the package you download. Patching belongs in a regular patch management routine, and finding every service that faces the internet is attack surface work.
How Can You Check Exposure Safely?
Check only servers you own. A safe check reads the version and sends nothing to the paths the attack uses. Do not request /player/timeline, /system/agents/ or the transcode paths to see whether a server is vulnerable.
On your own server, the version is under Settings, then General in Plex Web. This is the method Plex names. The README of one open-source compromise checker says it reads the version from the server’s local /identity endpoint, among other places.
We have not tested that on a Plex server, so treat it as a second check and not the first. If a reverse proxy hides the version, read it as “unknown, check by hand” and not as “safe”. Our EASM 101 guide explains how to list every service you expose.
How Do You Spot a Compromise?
Plex lists these signs for servers older than 1.43.3.10861 that were reachable from the internet:
- Processes started by Plex Media Server that you do not recognize, especially names like myawesomeproxy, mylovelyminer or x12345.
- Unfamiliar .so or .dll files in the Plex Codecs folder.
- Outbound connections to proxystream.st, or sustained high CPU while nothing is playing.
If you find any of these, or cannot rule them out, Plex advises a rebuild from a clean installation. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options you did not set. Sign out of all devices in your Plex account and change the password. Treat anything the Plex service account could reach, such as mounted shares and saved credentials, as exposed.
What Does Our Data Show?
We searched GitHub repository metadata for the four CVE ids and the name Plex2Shell, and public X posts and our dark web and chat monitoring for Plex2Shell, CVE-2026-96656 and Plex Media Server. We read repository descriptions and READMEs as text. We did not download or run any code, and we link no repository.
- 11Public GitHub repositories found for the CVE ids or the name Plex2ShellSource: Brandefense threat intelligence data, collected 23 October 2026
- 190Unique public X posts collected from 18 to 22 October (a floor, our search was capped)Source: Brandefense threat intelligence data, collected 23 October 2026
- 36Posts naming Plex2Shell in monitored chat channels and forums, 17 to 22 OctoberSource: Brandefense threat intelligence data, collected 23 October 2026
The earliest repository carrying the chain’s name was created on 17 October. By GitHub’s creation dates, the researcher’s own repository followed on 18 October. Its README describes an unauthenticated remote code execution chain and a tool for it, published for authorized testing.
By their own descriptions, the other nine repositories split into five defender tools and four others. The defender tools are three compromise checks or hunt scripts and two exposure scanners. The others are a Docker lab, a packet capture set, an incident write-up and a repository claiming proof of concept material for CVE-2026-96652.
Two READMEs say servers were being exploited in the wild by 17 October. Plex says only that attacks followed the proof of concept of 16 October. One incident write-up says an attacker planted a file in the codec folder that started a miner on every transcode. We could not verify these claims.
On X, posts peaked on the morning of 22 October, with 13 posts in the 05:00 UTC hour. Our keyword match flags 76 of the 190 posts as talking about exploitation and 30 as mentioning a proof of concept.
We did not check each claim. In dark web monitoring, 30 of the 36 posts are on Telegram, 4 on forums and 2 on Discord. We found none on Tor sites.
The counts show fast and wide attention. They do not show how many servers were hit. Plex’s own statement is the best evidence on scale.