CVE-2026-96652

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 18, 2026

Last Seen

November 6, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Plex2Shell Exploit Chain Actively Targeting Vulnerable Plex Servers72.9

A chain of vulnerabilities in Plex Media Server, termed Plex2Shell, is being by attackers to gain unauthorized access and deploy cryptocurrency miners and proxy software. The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, allow unauthenticated remote...

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Actively Exploited72.8

Arista Networks has patched a critical SQL injection vulnerability, CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that allows authenticated users to escalate privileges to superuser status. The flaw, rated 9.9 on the CVSS scale, has been actively exploited in the wild, affecting on-premises d...

ConnectWise App Identities Compromised, Microsoft 365 Tenants Breached72.0

On October 19, 2026, threat actors exploited an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF, allowing them to gain root or SYSTEM privileges. Concurrently, seven ConnectWise application identities were compromised, leading to unauthorized access to customer Microsoft...

QNAP Warns of Ongoing Plex2Shell Attacks on NAS Devices72.0

QNAP has issued an urgent advisory regarding ongoing attacks exploiting the Plex2Shell vulnerability chain, affecting its NAS devices. Users are urged to update Plex Media Server to version 1.43.3.10861 or later to mitigate risks. The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2...