A researcher’s public write-up and proof of concept for “Plex2Shell,” a chain of four Plex Media Server vulnerabilities, were followed within roughly a day by in-the-wild exploitation of internet-exposed servers. Observed payloads so far are an XMRig cryptominer and a proxy tool. The bugs were fixed in Plex Media Server 1.43.3.10861, but any exposed server still on an older build should be treated as a target now.
Timeline
- July 27, 2026: Researcher Zach Main reports the flaws to Plex.
- Patch: Plex ships 1.43.3.10861. Sources disagree on whether that was in August or early September; the fixed build number is consistent across them.
- October 16: Main publishes the technical write-up and a PoC repository covering all four CVEs.
- October 17: A honeypot operator running an old Plex build reports exploitation that morning. The first payload is an XMRig miner, with a proxy binary following later the same day.
The scale of exploitation is unknown. The public indicators come mostly from one Linux Docker honeypot, so treat the reported payloads as a floor rather than a full picture of the campaign.
The chain
Per the PoC repository, each CVE supplies one primitive:
| CVE | Primitive |
|---|---|
| CVE-2026-96652 | SSRF through the protocol= parameter of the /player/timeline endpoint |
| CVE-2026-96654 | Loopback pivot: requests forged by the SSRF reach services bound to localhost |
| CVE-2026-96655 | Transcoder SSRF with an arbitrary-path file write |
| CVE-2026-96656 | Code execution via dlopen of an unsigned codec, through the Codecs set-directory call |
In sequence, the attacker uses the timeline SSRF to reach localhost-only functionality, uses the transcoder bug to write a shared object to a chosen path, repoints the codec directory at it, and gets Plex to load the library, running code as the Plex service account. The researcher rates the combined chain 9.8.
Public scoring of the individual CVEs is inconsistent. NVD-derived entries list CVE-2026-96652 at a low CVSS (4.3 on v3.1), while other trackers rate CVE-2026-96656 much higher (8.6 on CVSS 4.0) and the chain as a whole as critical. Sources also disagree on whether the initial SSRF needs a valid X-Plex-Token. One analysis says the server only checks that a token is present, not that it is valid. Because of that, do not rely on “requires authentication” as a mitigating factor.
Who is affected
Any Plex Media Server before 1.43.3.10861, particularly instances with port 32400 forwarded to the internet or exposed through a reverse proxy. Self-hosted Plex frequently runs on home NAS devices, always-on Linux boxes and Docker containers, often with media volumes mounted writable and little monitoring. A compromise there gives an attacker free compute and a residential IP, which is exactly what the observed XMRig and proxy payloads monetize. Where the server shares a network with other lab or business systems, the foothold is also a pivot point.
Mitigation
- Update Plex Media Server to 1.43.3.10861 or later on every instance, including containers. Pull a fresh image rather than assuming a
latesttag is current. - Remove direct exposure. Disable port forwarding for 32400 where possible and put remote access behind a VPN or an authenticating reverse proxy.
- Hunt on servers that were exposed on or after October 16:
- Unexpected child processes of the Plex server process, especially miners or unfamiliar binaries.
- New or modified files in the Plex
Codecsdirectory, and.sofiles that are not Plex-signed. - Sustained high CPU, unknown outbound connections to mining pools, and unfamiliar listening proxy services.
- Requests to
/player/timelinewith a full URL in theprotocolparameter in access logs.
- If compromised, rebuild from a clean image and rotate the Plex token and any credentials or API keys readable by the service account. Don’t just kill the miner process.
- Containers: run Plex as a non-root user with a read-only root filesystem where feasible, and don’t mount host paths beyond the media library and config.
Takeaway
The gap between PoC publication and mass exploitation was about a day, and the fix had been available for weeks. Consumer-grade server software on exposed ports gets scanned and weaponized as quickly as enterprise edge devices.