Skip to content
Urgent Update Required for Vulnerable Plex Media Servers Amid Active Exploitation

Urgent Update Required for Vulnerable Plex Media Servers Amid Active Exploitation

First seen 19 Oct 2026, 02:16 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 03:50 UTC
  • •Plex Media Server vulnerabilities allow unauthenticated remote code execution.
  • •Over 36,000 servers remain vulnerable despite patch recommendations.
  • •Active exploitation observed with cryptocurrency miners being deployed.

Plex Media Server users are urged to update their software immediately due to the active exploitation of a vulnerability chain known as Plex2Shell, which allows unauthenticated remote code execution. This chain involves four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, affecting versions prior to 1.43.3.10861. Despite Plex notifying users to upgrade by September 1, many servers remain vulnerable, with over 36,000 instances still exposed. A proof-of-concept was published on October 16, 2026, and attacks were observed on October 17, delivering cryptocurrency miners and proxy applications. The exploitation method includes server-side request forgery and arbitrary file writes, leading to remote code execution. Community reports of compromised servers have not been confirmed by Plex or CISA. Users are advised to check for unexpected processes and files in their installations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-01
Plex urges users to update
Plex notified users to upgrade to version 1.43.3.10861 to mitigate vulnerabilities.
Cordcuttersnews
2026-09-23
CVE-2026-96654 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96652 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96656 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96655 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-16
Proof-of-concept published
A researcher released a full write-up and PoC for the Plex2Shell vulnerability chain.
X
2026-10-17
Exploitation observed
A honeypot running an older Plex version was compromised, showing active exploitation of the vulnerabilities.
Cordcuttersnews

More articles in this cluster (5)

Following this threat?

Track Myawesomeproxy and CVE-2026-96652 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3

Common questions

Which versions of Plex are affected?
Plex Media Server versions prior to 1.43.3.10861 are affected by the vulnerabilities.
What should I do if my server is vulnerable?
Immediately update to version 1.43.3.10861 or later to mitigate the risk of exploitation.
Have there been confirmed attacks using these vulnerabilities?
Yes, active exploitation has been observed with cryptocurrency miners being deployed on compromised servers.