Cybercriminals began targeting a new set of Plex Media Server flaws just one day after researchers disclosed the details and released proof‑of‑concept code. The vulnerabilities, identified as CVE‑2026‑96652, CVE‑2026‑96654, CVE‑2026‑96655 and CVE‑2026‑96656, allow attackers to gain remote code execution on affected servers.
The initial disclosure came on October 16, when a security researcher posted a detailed write‑up and working exploit. Within hours, threat actors were observed distributing cryptocurrency mining software and proxy tools that leveraged the four bugs. The attacks were observed across multiple countries, with attackers targeting Plex installations that were not updated to the latest patch.
The Plex2 Shell chain comprises four separate vulnerabilities, each contributing to a larger attack surface. The first flaw, CVE‑2026‑96652, permits arbitrary file upload. The second, CVE‑2026‑96654, allows remote code execution through a crafted request. CVE‑2026‑96655 exploits a directory traversal bug, and CVE‑2026‑96656 enables privilege escalation. By chaining these exploits, attackers can install malicious binaries, mine cryptocurrency, and set up proxy services to tunnel traffic.
Security researchers noted that the chain was designed to evade basic intrusion detection systems. The attackers’ use of a lightweight proxy component allows them to hide malicious traffic behind legitimate Plex traffic, making detection difficult for standard monitoring tools.
Why are attackers focusing on Plex servers? Plex is popular among home users and small businesses for media streaming, and many installations run on outdated operating systems. The attackers prioritize servers that expose the Plex Web UI to the internet without proper authentication or that lack recent security updates. By exploiting the four CVEs, they can bypass authentication entirely and gain full control of the host.
The rapid deployment of these exploits highlights the need for immediate patching. Organizations using Plex should verify that they are running the latest version and have disabled remote access where possible. Failure to do so could result in unauthorized access, data theft, or the use of the server’s resources for illicit mining. Cybersecurity experts warn that similar chains of vulnerabilities could emerge in other popular software, underscoring the importance of proactive vulnerability management.
What should users do if they run Plex Media Server? Update to the latest version immediately and disable remote access if not required.
Can the vulnerabilities be exploited without internet exposure? The chain requires remote access to the Plex Web UI; servers behind strict firewalls are less likely to be affected.
Will future updates address all four CVEs? Yes, the vendor has released a patch that closes all four vulnerabilities and recommends installing it without delay.