TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1104-21Exploited in the wild
Plex2Shell (CVE-2026-96652 chain): four medium flaws that add up to unauthenticated RCE
Four Plex Media Server flaws, none critical on its own, chain into unauthenticated remote code execution. An SSRF on /player/timeline starts it; a path-control flaw finishes it. Exploited in the wild since mid-October to drop cryptominers and proxies, and all four are in CISA KEV. Update to 1.43.3.10861 or later, then check for compromise.
SEVERITY
Critical (chained)
PEAK CVSS
8.6
AUTH REQUIRED
None (chain)
PUBLIC POC
Yes
PUBLISHED
Nov 4, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
Every bug in this set would pass a severity triage. A 5.3 here, a 6.9 there. Individually, the kind of finding that waits for the next maintenance window. Chained together, they hand an attacker a shell with no login.
Plex2Shell links four Plex Media Server flaws. It opens with an unauthenticated server-side request forgery on /player/timeline that makes the server POST to any destination, including its own internal APIs, and closes with an external file-path flaw that lets attacker-controlled code run on load. The result is unauthenticated remote code execution. Attackers started using it in mid-October against internet-exposed Plex servers, dropping cryptominers and proxyware.
This is the blind spot in score-driven patching. Scanners rank each CVE in isolation, so a chain of mediums never rises to the top of the queue, yet that is exactly how modern intrusions work: stack the unremarkable until they become critical. The only way to see a chain is to follow the path an attacker would take, step by step, rather than sorting a list by number. Plex is often a shadow asset too, an app someone installed, not an app security tracked, which is why finding every instance is half the battle.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking Plex2Shell, a chain of four Plex Media Server flaws that together enable unauthenticated remote code execution. No single flaw is critical, which is why score-driven triage misses the chain. It starts with an unauthenticated SSRF on /player/timeline and ends with attacker-controlled file execution. Plex confirmed active, widespread exploitation from mid-October, dropping cryptominers and proxyware, and all four CVEs are in CISA KEV. Update to 1.43.3.10861 or later and check exposed servers for compromise.
KEY JUDGMENTS
01
Plex confirmed the chain is being actively and widely exploited from around Oct 16-17, 2026, initially dropping a cryptominer. CISA added all four CVEs to KEV on Oct 20.Observed
02
The individual scores (5.3 to 8.6) understate the risk. Chained, they yield unauthenticated RCE, which no single-CVE score reflects.Assessed
03
The entry point, CVE-2026-96652, is an unauthenticated SSRF on /player/timeline; the chain reaches code execution via external file-path control (CVE-2026-96656).Reproduced
04
Plex is frequently a shadow asset, installed by individuals or on NAS devices outside the security inventory, so discovery is a core part of remediation.Assessed
CWE-918 SSRF on /player/timeline (unauthenticated)
Finisher
CWE-73 external control of file name or path (8.6)
Chained outcome
Unauthenticated remote code execution
Affected
Plex Media Server before 1.43.3.10861
Scoring
Individually 5.3 to 8.6; critical in combination
Fix
Plex Media Server 1.43.3.10861 (Aug 3, 2026)
EXPOSURE: PLEX BELOW THE FIX, REACHABLE
01Plex Media ServerAny install below 1.43.3.10861.
02ReachableThe web interface is reachable by an attacker.
03Shadow assetsPersonal, NAS, or lab installs outside the inventory.
04Internet-exposedRemote-access-enabled servers are the priority.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedWidespread from mid-October.
CISA KEV4 CVEs listedAdded Oct 20.
PUBLIC POCAvailableChain write-up published.
PATCHAvailable1.43.3.10861, Aug 3.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Jul 27Researcher Zach Main reports the flaws to Plex.
Aug 3Plex Media Server 1.43.3.10861 ships with the fixes.
Oct 16-17A chain write-up appears and Plex2Shell exploitation begins in the wild, dropping a cryptominer against exposed servers and honeypots.
Oct 20CISA adds all four Plex CVEs to KEV, with staged federal deadlines.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Exposure is any Plex Media Server below the fixed build, including the ones no one is tracking. The chain, not any single CVE, is what makes it critical.
ITEM
AFFECTED
FIXED IN
STATUS
Plex Media Server
before 1.43.3.10861
1.43.3.10861 or later
Fixed
Internet-exposed Plex
remote access enabled
update, then check for compromise
Priority
Plex on NAS / personal devices
often unpatched shadow assets
find and update
Higher risk
Plex on 1.43.3.10861+
not affected
keep auto-update on
Fixed
FIND IT FIRSTPlex is often installed outside IT’s view, on NAS boxes, home-office machines and labs. Discovery is half the job: you cannot patch or validate a server you do not know exists.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-exposed Plex serversUpdate to 1.43.3.10861 or later now, then check for cryptominers and proxyware.
Any reachable Plex below the fixTreat as chainable to unauthenticated RCE and patch.
HighWithin 72 hours
Shadow and NAS installsFind Plex instances outside the inventory and bring them to the fixed build.
Exposed serversHunt for unexpected processes, outbound connections and dropped binaries.
Remote accessReconsider whether each Plex server needs to be internet-reachable at all.
HighBefore closing
Every serverRecord the version and the compromise-check result as evidence.
WORKAROUNDS
Update to 1.43.3.10861. The fix. There is no configuration that closes the full chain on an older build.Remove internet exposure. Disable remote access, or front Plex with a VPN, where public reach is not required.Hunt before trusting. Check exposed servers for miners, proxyware and unexpected outbound traffic.Restrict the token. Limit the X-Plex-Token to trusted clients to reduce the SSRF entry point.
06 · DETECTION AND HUNTING
Observables and hunting queries
Exploitation drops miners and proxyware, so hunt on version, on the SSRF entry pattern, and on the resource and network signs of a miner.
TYPE
OBSERVABLE
SOURCE
Request
Unusual protocol parameter values and elevated /player/timeline volume
Plex application logs
Behavior
The Plex process spawning unexpected binaries or outbound connections
EDR, host telemetry
Behavior
Sustained high CPU and connections to mining pools
Host and network monitoring
HUNT · Plex2ShellSSRF entry pattern
# Plex logs: anomalous protocol= values and /player/timeline request spikes
HUNT · Plex2Shellminer and proxyware signs
# host: Plex process spawning binaries; network: connections to mining pools
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Impact
T1496
Resource Hijacking (cryptomining)
Observed
08 · TECHNICAL ANALYSIS
Root cause and attack path
Plex2Shell is a chain, and the chain is the point. It begins with CVE-2026-96652, an unauthenticated server-side request forgery in the /player/timeline endpoint: the endpoint accepts a full URL in a protocol parameter and makes the server send a POST to that destination, including its own internal APIs. From there the chain uses the other three flaws, an encoded-URI-scheme neutralization issue (96654), a second SSRF that can disclose the server owner’s admin token (96655), and external control of a file name or path (96656, 8.6), to turn server-initiated requests and a stolen token into attacker-controlled file execution.
No single step is dramatic. The individual scores run from 5.3 to 8.6, the range a scanner lists as medium-to-high and a busy team schedules for later. Chained, they produce unauthenticated remote code execution on an internet-exposed media server. Plex fixed all four in 1.43.3.10861 on August 3, but exploitation began in mid-October after a public write-up, dropping cryptominers and proxyware. The defensive lesson is that severity scores rank CVEs in isolation while attackers compose them, so the way to see a chain is to walk the path, not to sort the list.
01 SSRF
Unauthenticated POST to any destination via /player/timeline
Authenticated SSRF that can disclose the server owner’s admin token.
AssessedAttackers compose vulnerabilities; scanners rank them one at a time. A chain of mediums that ends in unauthenticated RCE is why the path matters more than the score.
09 · VALIDATION
Confirm remediation
A per-CVE score is not a verdict for a chain. Each Plex server should end with evidence: on the fixed build, reachability controlled, and checked for the miner and proxyware the chain drops.
01
Find every Plex Media Server
Include NAS, personal and lab installs outside the inventory.
# scan for Plex Media Server (default web port 32400) across managed and BYO networks
02
Read the version
Confirm 1.43.3.10861 or later per server.
# read the version in Settings > General, or from the server logs
03
Check reachability
Determine which servers are internet-exposed via remote access.
# in scope: confirm whether the Plex web interface is reachable externally
04
Walk the chain, in scope
Confirm the SSRF entry on /player/timeline is closed on the patched build.
# approved test only: confirm /player/timeline rejects attacker-controlled protocol URLs
05
Hunt for compromise
Look for miners, proxyware and unexpected outbound connections on exposed servers.
# host and network review for mining-pool traffic and unexpected Plex child processes
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-96652
01Do you have any Plex Media Server installs, including on NAS or personal devices?
02Is any of them below version 1.43.3.10861?
03Is any Plex server reachable from the internet via remote access?
04If an exposed server was unpatched, have you checked it for cryptominers and proxyware?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Plex security notice and release 1.43.3.10861
›CISA Known Exploited Vulnerabilities catalog (four Plex CVEs added Oct 20, 2026)
›BleepingComputer: CISA warns of Plex2Shell attacks
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is Plex2Shell being exploited?
Yes. Plex confirmed active, widespread exploitation from mid-October 2026, initially dropping a cryptominer, and CISA added all four CVEs to KEV on October 20.
Why is a chain of medium CVEs critical?
Each flaw scores medium to high alone, but chained they produce unauthenticated remote code execution, which no single score reflects.
Which version fixes it?
Plex Media Server 1.43.3.10861, released August 3, 2026, or later.
I updated. Am I safe?
If an exposed server ran an older build, check it for cryptominers and proxyware; the update does not remove what was already dropped.
VALIDATE YOUR EXPOSURE
Prove your Plex exposure, chain and all
Hayrok finds Plex servers across managed and shadow networks, reads the version, and walks the Plex2Shell path step by step to show whether the chain is actually reachable. Every result lands in Evidence Fabric.