CVE-2026-96656
CVSS 7.2 HIGH: plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. EPSS 0.4% (32nd percentile).
Vulnerabilities · 1h ago
SecurityWeek reports attackers were exploiting a four-vulnerability Plex Media Server chain by Oct. 17, one day after a working proof of concept went public. A researcher’s internet-facing honeypot recorded the attacks, which dropped an XMRig cryptocurrency miner and, later, myawesomeproxy, a proxy tool.
The chain lets attackers run code on exposed servers without credentials, with Plex service privileges. The proxy can send someone else’s traffic through the server’s home internet connection, making it appear to come from a residential IP. The same foothold can therefore support mining and lend a residential network identity to outside activity.
Plex had shipped fixes by Sept. 1, but the honeypot’s indicators cover only activity seen there, and the reporting does not establish whether proxy traffic was actually relayed or what happened on other compromised hosts. For organizations whose remote-access or fraud controls trust residential-looking addresses, a patched Plex server may still leave an unanswered question about prior abuse of its network identity.
CVSS 7.2 HIGH: plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. EPSS 0.4% (32nd percentile).
CVSS 6.5 MEDIUM: plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an… EPSS 0.2% (13th percentile).
CVSS 4.3 MEDIUM: plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. EPSS 0.2% (12th percentile).
CVSS 4.3 MEDIUM: plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external… EPSS 0.2% (12th percentile).
2 sources covering this story
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Attackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
Part of the PlainSec briefing for 2026-10-19