CISAAnalysisCISA adds Plex2Shell remote code execution exploit chain to Known Exploited Vulnerabilities catalog
What happened.CISA added four chained vulnerabilities impacting Plex Media Server to its Known Exploited Vulnerabilities catalog after confirming active exploitation by threat actors in the wild.
Why it matters.Exposed media server infrastructure frequently sits directly within internal home lab and corporate office subnets. Once compromised, these nodes serve as jump points for lateral network reconnaissance and credential harvesting. Security administrators must upgrade host installations to version 1.43.3.10861 or block inbound internet access to media streaming ports.
The technical specifications:
- Exploit chain: The sequence links a server-side request forgery in timeline endpoints with plugin input validation flaws across CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
- Payload deployment: Unauthenticated remote intruders hijack administrator tokens and execute arbitrary system commands to install persistent cryptocurrency miners and proxy network daemons.
- Vendor remediation: Plex resolved the vulnerabilities in server build 1.43.3.10861. Federal civilian agencies must apply patches or disconnect exposed instances under Binding Operational Directive 26-04 deadlines.