CISA added six vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. Four of them are Plex Media Server flaws that researchers have chained together into what is being called Plex2Shell.
The four Plex entries are CVE-2026-96652 and CVE-2026-96655 (server-side request forgery), CVE-2026-96654 (improper neutralization of encoded URI schemes) and CVE-2026-96656 (arbitrary file write). The remaining two are CVE-2026-106931, an OS command injection in EG Secure Solutions SiteGuard Server Edition, and CVE-2026-110936, an uncontrolled search path element in Siemens Software Center.
What Plex2Shell actually does
Security firm Censys documented how the four Plex flaws chain together to give unauthenticated remote code execution as the account running the Plex server. Individual CVSS scores were reported as 4.3, 6.5, 4.3 and 7.2, but chained they are far more serious than the highest single score suggests. Censys reports compromised servers have been used to run cryptocurrency miners and proxy malware.
Plex shipped a fix in build 1.43.3.10861, and its own security notice for the underlying flaws was first posted on September 1, 2026. That timing matters: the patch predates the federal directive by roughly seven weeks, so a server patched in September was already protected.
What the KEV listing changes
Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching KEV-listed flaws, particularly on publicly exposed assets that would grant an attacker total control after exploitation. The listing is a US federal requirement, not a general consumer instruction, but it is a useful signal of which flaws are being used in the wild right now.
Plex advises treating anything the service account can reach as potentially exposed if a server was compromised: that includes mounted network shares and stored credentials. If you run Plex on a machine that also holds other services or shared drives, that is the exposure to think about.
If you run a Plex server
Check the build number against Plex’s security notice rather than assuming a recent update covered it. If your server accepted connections from outside your home network and you have not patched since September, assume it may have been reachable by the same chain Censys described.
For the wider picture on how a similar disclosure played out this month, our report on the PHP vulnerabilities found with AI assistance covers another case where governments and organisations took sites offline to patch.
What we did not do
We did not run or reproduce the exploit, and we did not verify how many Plex installations were actually compromised. Censys’s account of miner and proxy software on compromised servers is its own research; Plex’s advisory does not give a count of affected installations.
Sources
- CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog
- Censys — Plex2Shell advisory (CVE-2026-96652, 96654, 96655, 96656)
- BleepingComputer — CISA: Hackers chain Plex flaws in Plex2Shell attacks
- Plex — Important security update for Plex Media Server v1.43.2 and earlier
- Honest Fred — AI Agents Found Critical PHP Flaws and Forced a Global Patch
