CISA Adds CVE-2026-96655 in Plex Media Server to KEV Catalog
CISA added the CVE-2026-96655 vulnerability in Plex Media Server to the KEV catalog. It is one of four flaws in the Plex2Shell chain reportedly used against unpatched servers, according to security media.
On October 20, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2026-96655 vulnerability in Plex Media Server to the Known Exploited Vulnerabilities (KEV) catalog. It is one of four flaws in the chain known as Plex2Shell, which can lead to unauthenticated remote code execution on a vulnerable server when multiple weaknesses are combined.
An entry in the KEV catalog means that CISA has recorded exploitation of the flaw in practice. For Plex Media Server administrators, this is a reason to prioritize updating and checking for possible compromise, especially if the server is accessible from the internet.
CVE-2026-96655 in the Plex2Shell Chain
CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability in Plex Media Server versions older than 1.43.3.10861. An authenticated user can use the /video/:/transcode/universal path parameter to trigger requests to internal or external addresses.
The flaw therefore requires login. CISA, however, cites the possibility of chaining it with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. This combination can lead to unauthenticated remote code execution on the affected instance.
A fix for the entire group of vulnerabilities is available in Plex Media Server version 1.43.3.10861. According to the CISA CSAF record, this version was released on August 3, 2026.
Attacks on Unpatched Plex Servers
Security media have recorded attacks using the Plex2Shell chain against unpatched and publicly accessible Plex servers. A cryptocurrency miner and a Linux proxy/backdoor were reportedly deployed on compromised systems.
It has not been publicly confirmed how many servers were compromised or who is behind the campaign. It also has not been independently confirmed that every reported miner or proxy program found on a Plex server is related specifically to this chain of flaws.
What Administrators Should Do
Administrators should update Plex Media Server to at least version 1.43.3.10861. Particular attention is required for unpatched instances directly accessible from the internet, where the risk of exploitation is highest.
- Check the installed Plex Media Server version and deploy the available fix.
- Check servers for unknown processes or suspicious proxy or mining software.
- Verify whether public server access is necessary.
Further developments may bring a statement from Plex about the scope of the attacks and indicators of compromise. New information from security companies about the malware tools used and possible attribution of the campaign may also be expected.
Sources
- CISA Known Exploited Vulnerabilities Catalog – CISA added CVE-2026-96655 to the known exploited vulnerabilities and cites its chaining with related flaws.
- CISA CSAF advisory: Plex Media Server – Describes the scope of CVE-2026-96655, affected versions before 1.43.3.10861, and the available fix.
- The Hacker News – Corroborates observed exploitation of the Plex2Shell chain to spread a miner and Linux proxy/backdoor.
Verified and updated: October 21, 2026 06:24
