INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

CISA Identifies Plex Flaws Exploited in Breach of Servers

| 2026-10-21 18:34 HIGH HIGH DATA BREACH VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
Hackers are actively exploiting four vulnerabilities in Plex Media Server, collectively known as Plex2Shell. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers can obtain the owner's admin token and execute code with elevated privileges when chaining these flaws. These vulnerabilities were discovered by security researcher Zach Main on July 27 and include CVE-2026-96652, an SSRF flaw in /player/timeline; CVE-2026-96654, a URL injection flaw in searchOne; CVE-2026-96655, an authenticated SSRF flaw in the transcoder endpoint; and CVE-2026-96656, an arbitrary file write flaw in the transcoder settings. The vulnerabilities affect Plex Media Server versions before 1.43.3.10861, which was released on August 4. CISA has directed federal agencies to prioritize patching systems affected by these vulnerabilities or apply mitigations by October 23.
Technical Mitigations AI-generated
• Patch Plex Media Server to version 1.43.3.10861 or later. • Block or hunt for the SSRF flaw in /player/timeline (CVE-2026-96652) and the URL injection flaw in searchOne (CVE-2026-96654). • Detect and prevent the arbitrary file write flaw in the transcoder settings (CVE-2026-96656) by monitoring shared library modifications. • Hunt for the uncontrolled search path element flaw in Siemens Software Center (CVE-2026-110936).
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-96655CVE-2026-96655 CVE-2026-96652CVE-2026-96652 CVE-2026-106931CVE-2026-106931 CVE-2026-96654CVE-2026-96654 CVE-2026-110936CVE-2026-110936 CVE-2026-96656CVE-2026-96656
Target & Sectors
DACH DACH governmentgovernment
Incident Timeline
‎July 27
Security researcher Zach Main discovered security issues in Plex that were later exploited by hackers to breach servers.
‎August 4
Threat actors exploited vulnerabilities in Plex Media Server versions before 1.43.3.10861, released on August 4, to breach servers using the Plex2Shell attacks.
infrastructure 1.43.3
Plex2Shell impacts Plex Media Server versions before 1.43.3.10861, which was released on August 4 .
tactic T1584.004 - Server
Plex2Shell impacts Plex Media Server versions before 1.43.3.10861, which was released on August 4 .
‎2026/10/14
Threat actors exploited the CVE-2026-106931 vulnerability in Plex to breach servers.
target_region Japan
Both the vendor and Japan's CERT flagged CVE-2026-106931 as actively exploited late last week.
vulnerability CVE-2026-106931
Both the vendor and Japan's CERT flagged CVE-2026-106931 as actively exploited late last week.
attribution CERT
Both the vendor and Japan's CERT flagged CVE-2026-106931 as actively exploited late last week.
general_metric 106931 CVE-2026
Both the vendor and Japan's CERT flagged CVE-2026-106931 as actively exploited late last week.
‎October 16
Threat actors used the Plex2Shell vulnerabilities published by Zach Main on October 16 to chain exploits and breach servers.
organisation Plex2Shell
Zach Main published full technical details for the Plex2Shell vulnerabilities on October 16, followed by a proof-of-concept (PoC) exploit three days later.
organisation PoC
Zach Main published full technical details for the Plex2Shell vulnerabilities on October 16, followed by a proof-of-concept (PoC) exploit three days later.
‎October 17
Threat actors exploited existing Plex flaws in the wild to deploy a cryptominer, initially targeting Plex honeypots.
‎October 19
The German technology giant warned on October 19 that hackers were leveraging a vulnerability in the ClickFix delivery platform Romulus to breach servers.
target_region Germany
The German technology giant  warned on October 19  that hackers were leveraging the vulnerability in campaigns linked to a multi-payload ClickFix delivery platform called Romulus.
organisation ClickFix
The German technology giant  warned on October 19  that hackers were leveraging the vulnerability in campaigns linked to a multi-payload ClickFix delivery platform called Romulus.
‎2026/10/21
Hackers are actively exploiting four vulnerabilities in Plex Media Server, including CVE-2026-96656 and CVE-2026-96652, to breach servers.
organisation CVE-2026-96652
CVE-2026-96652 – An SSRF flaw in /player/timeline that allows unauthenticated attackers to make Plex send POST requests to arbitrary destinations, including its own internal APIs.
organisation POST
CVE-2026-96652 – An SSRF flaw in /player/timeline that allows unauthenticated attackers to make Plex send POST requests to arbitrary destinations, including its own internal APIs.
organisation CVE-2026
CVE-2026-96654 – A URL injection flaw in searchOne that allows attackers to invoke other plugins’ functions with attacker-controlled parameters.
organisation CVE-2026-96655
CVE-2026-96655 – An authenticated SSRF flaw in the transcoder endpoint that allows users to make Plex request arbitrary internal or external addresses.
organisation CVE-2026-96656
CVE-2026-96656 – An arbitrary file write flaw in the transcoder settings that allows administrators to plant malicious shared libraries that Plex subsequently loads, leading to code execution.
infrastructure 8.00
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
infrastructure 7.00
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
organisation Nginx
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
organisation Plex Media
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
organisation Known Exploited
Hackers also target Siemens Software Center Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities ( KEV ) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).
organisation KEV
Hackers also target Siemens Software Center Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities ( KEV ) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).
organisation SSC
Hackers also target Siemens Software Center Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities ( KEV ) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).
infrastructure 4.0.9
" Siemens's alert on CVE-2026-110936 shares indicators of compromise (IoCs) and advice on identifying compromised systems, urging administrators to update Siemens Software Center to version 4.0.9.8 or later.
organisation Siemens
" Siemens's alert on CVE-2026-110936 shares indicators of compromise (IoCs) and advice on identifying compromised systems, urging administrators to update Siemens Software Center to version 4.0.9.8 or later.
organisation Plex
Hackers chain Plex flaws in Plex2Shell attacks to breach servers.
organisation Forescout
Recent research from operational technology (OT) cybersecurity company Forescout notes that Romulus "may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎October 23
CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23.
Tactical Metrics
Metrics
infrastructure
‎1.43.3
Software Version
Plex2Shell impacts Plex Media Server versions before 1.43.3.10861, which was released on August 4 .
Metrics
infrastructure
‎4.0.9
Software Version
" Siemens's alert on CVE-2026-110936 shares indicators of compromise (IoCs) and advice on identifying compromised systems, urging administrators to update Siemens Software Center to version 4.0.9.8 or later.
Metrics
infrastructure
‎8.00
Software Version
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
Metrics
infrastructure
‎7.00
Software Version
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
Intelligence Sources
BleepingComputer 2026-10-21