Plex2Shell: Four Medium-Severity Bugs Became a 9.8 Pre-Auth RCE. CISA Only KEV'd Four of the Five.
None of the individual Plex Media Server CVEs scores above 7.2. Chained together, they're an unauthenticated remote shell — and they were already mining Monero on unpatched servers within 24 hours of the public write-up.
Overview
Five bugs were disclosed together against Plex Media Server on September 23, 2026. Read in isolation, none of them looks urgent: the worst single CVE scores 7.2 (High), and three of the five are Medium. Chained together by a researcher who goes by zmain (GitHub handle code-zm), they're an unauthenticated path from an ordinary network request to code execution as the Plex process — and on October 20, four of the five landed on CISA's Known Exploited Vulnerabilities catalog after real attackers beat the public write-up to the punch by less than 24 hours.
Scores as of October 28, 2026live record →
The chain: how four 'medium' bugs add up to a shell
Plex's own companion-device protocol and plugin architecture trust each other more than they trust the network. zmain's write-up walks the chain as a sequence of small, individually-patchable trust failures that only become dangerous laid end to end.
Plex2Shell: from an anonymous request to code execution
- POST to /player/timeline with any X-Plex-Token — The endpoint checks that the token header is present, not that it's valid — CVE-2026-96652. The 'protocol' parameter can carry a full URL.
- Server SSRFs itself to a forged loopback call — The forced request lands on Plex's own /system/agents plugin API, which trusts loopback-origin traffic with no re-authentication — CVE-2026-96654's URL/identifier injection lets it invoke another plugin's function with attacker-chosen parameters.
- Owner's admin token leaks via a prefix-match bug — Plex attaches the server owner's token to any outbound request whose URL merely starts with 'http://127.0.0.1'. A crafted sslip.io hostname passes that check but resolves via DNS to the attacker's own server.
- Owner token used to set a malicious transcoder preference — With admin rights, the attacker sets TranscoderH264Options to x264's debug 'dump-yuv' flag, pointing the output at Plex's own Codecs directory — CVE-2026-96656.
- Transcode job writes a shared library to disk — Triggering a transcode against an attacker-hosted video causes x264 to write bit-exact frames — really a smuggled ELF .so file — to the target path.
- Code execution as the plex user — Plex's codec loader dlopen()s any .so file in the Codecs directory at transcoder startup, with no signature or naming check. The planted library's constructor runs on load.
Five CVEs, one patch, and one deliberate KEV exclusion
| CVE | Bug | CWE | CVSS v3.1 (our catalog) | EPSS percentile | On CISA KEV? |
|---|---|---|---|---|---|
| CVE-2026-96651 | Path traversal reads any file incl. the owner's auth token | CWE-22 | 6.5 Medium | 57th | No |
| CVE-2026-96652 | SSRF via /player/timeline, token header not validated | CWE-918 | 4.3 Medium | 79th | Yes — Nov 3 deadline |
| CVE-2026-96654 | URL/identifier injection in the agent search API | CWE-84 | 6.5 Medium | 80th | Yes — Oct 23 deadline |
| CVE-2026-96655 | SSRF via the transcoder path parameter | CWE-918 | 4.3 Medium | 76th | Yes — Nov 3 deadline |
| CVE-2026-96656 | Admin file write via a transcoder preference | CWE-73 | 7.2 High | 78th | Yes — Oct 23 deadline |
What actually happened once the write-up went public
Severity on paper vs. severity in the campaign that followed
- Worst individual CVSS score: 7.2 (High), CVE-2026-96656 alone
- Looks like five separate patch tickets
- CVEs public since Sept 23 with no PoC in sight
- No payload reported pre-disclosure
- Chain-level CVSS 9.8 (Critical), unauthenticated, per the researcher
- One build, 1.43.3.10861, fixes all five at once
- First honeypot hit within 24 hours of the Oct 16 write-up
- XMRig cryptominer plus a residential-proxy tool ('myawesomeproxy') dropped on compromised servers
From private report to KEV listing
- Researcher reports the chain to Plex's security contact
- Plex acknowledges the report and pays a bounty
- Plex ships 1.43.3 as an unlabeled security release — no CVEs assigned yet
- Shadowserver reports 36,000+ exposed, unpatched Plex instancesAt this point the flaws had no CVE IDs; Shadowserver itself warned they were "invisible to the security community limiting an effective response."
- CISA (as CNA) publishes all five CVE records for build 1.43.3.10861
- zmain publishes the full Plex2Shell proof-of-concept write-up
- First in-the-wild exploitation caught by an independent honeypot, dropping XMRig and myawesomeproxy
- Plex confirms the bugs are "being actively and widely exploited"
- CISA adds four of the five CVEs to KEV with staggered Oct 23 / Nov 3 federal deadlines
The 36,000-server figure is the number we're most reluctant to carry forward uncritically: it's a Shadowserver scan from early September, taken against builds that weren't even tied to named CVEs yet. By the time the PoC and KEV listing landed in mid-October, Plex 1.43.3 had been out for over four months — some of those 36,000 will have patched in the interim, and the actual count of vulnerable, internet-facing Plex servers on October 20 is unpublished. Treat it as a floor on how badly this class of self-hosted software gets left unpatched, not a live exposure count. See our trend tracking for how KEV-add volume has moved this quarter.
Neither of these is a published Sigma/Suricata/Nuclei signature — we didn't find one. They're sourced guidance, labeled as such.
What to do now
- Patch to Plex Media Server 1.43.3.10861 or later now — this single build fixes all five CVEs.
- Do not treat patching as cleanup: Plex itself and CISA both note that updating does not remove an existing infection.
- Check the Codecs directory for unfamiliar .so files, and process lists for XMRig or myawesomeproxy before and after patching.
- Rotate the server owner's Plex auth token — the chain's entire purpose is stealing that token, so assume it's burned if your server was exposed and unpatched.
- If Plex doesn't need to be reachable from the open internet, put it behind a VPN or an authenticating reverse proxy instead of exposing the port directly.
CVE and KEV data as of October 28, 2026
Sources: CISA CSAF advisory VA-26-266-01 · CISA — KEV catalog addition, Oct 20, 2026 · CVE.org record — CVE-2026-96656 · zmain — Plex2Shell technical write-up (original discovery)