Unauthenticated RCE chain (Plex2Shell) via SSRF and arbitrary file write in Plex Media Server (CVE-2026-96656)
CISA added the four Plex2Shell CVEs to KEV on 2026-10-20 with remediation deadlines from 2026-10-23 after exploitation began a day after a public proof of concept, so an internet-reachable Plex server left below 1.43.3.10861 should be assumed to be a target for miner and proxy implants.
CVE-2026-96656 lets an admin-level request write arbitrary files that Plex executes on load; chained with the SSRF flaws CVE-2026-96652 and CVE-2026-96655 and the encoded URI scheme flaw CVE-2026-96654 (together called Plex2Shell), it allows arbitrary code execution on an exposed Plex Media Server without valid credentials. Attackers have been observed using the chain to install cryptocurrency miners and proxy software.
Affected: Plex Media Server < 1.43.3.10861 (all platforms, including NAS app-store builds)
How to Test
Check the installed Plex Media Server build in the server settings/about screen; any build below 1.43.3.10861 is affected. Determine whether the server is reachable from the internet (remote access enabled or a forwarded port). On affected servers, look for unexpected cryptocurrency-miner or proxy processes running under the Plex service account, unexpected newly written files in the Plex application/data directories, and unusual API requests from external addresses in the server's access logs.
How to Patch
Upgrade Plex Media Server to 1.43.3.10861 or later. App-store builds (e.g. QNAP) may lag behind the direct download; until the fixed build is installed, remove the server from internet exposure by disabling remote access and closing the forwarded port.