Researchers Detail Plex Media Server RCE Chain, Confirm Active Wild Exploitation
Attackers are actively exploiting a four-flaw chain in older Plex Media Server versions to install cryptocurrency miners and proxy software.
Key points
- An unauthenticated remote code execution chain affects Plex Media Server versions prior to 1.43.3.10861.
- Researchers confirmed active exploitation of this chain on October 17, with attackers deploying crypto miners.
- The vulnerability chain involves four CVEs patched in an August update, though many users remain unpatched.
Security researchers have confirmed that attackers are actively exploiting a critical remote code execution chain in older versions of Plex Media Server to install malicious software. As Threat Times reported on October 19, attackers are chaining four recently fixed flaws to install cryptominers and proxy software on unpatched devices. This activity targets servers that have not been updated since the August security release.
The exploitation involves an unauthenticated remote code execution chain known as Plex2Shell, which allows attackers to gain full control of a server without valid login credentials. According to a technical write-up published on Thursday by researcher ZM, the chain strings together four specific vulnerabilities. An attacker can trick the server into revealing the owner’s admin token and then plant a malicious file that executes when the Plex service transcodes video content.
Context and Background
The four vulnerabilities involved in this chain are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. ZM reported these issues to Plex on July 27. The company acknowledged the findings and paid a $500 bug bounty on August 4, the same day the fixed build became publicly available for download. The CVEs were officially assigned on September 23, following Plex’s request.
Despite the availability of a fix, the $500 payout for such a critical exploit drew criticism online. Multiple users on the social platform X questioned whether the researcher had forgotten zeros in the payout amount, suggesting the reward was disproportionately low for the severity of the unauthenticated remote code execution flaw.
Who Is Affected
Users running Plex Media Server versions prior to 1.43.3.10861 are affected by this vulnerability chain. On September 1, Plex posted a public advisory and, according to BleepingComputer, emailed users still operating on older versions. The company urged all server owners and desktop users to update to the latest version as soon as possible to prevent unauthorized access.
Evidence of real-world exploitation emerged from an anonymous blogger who runs boredhackerblog. This individual set up a vulnerable Plex server as a honeypot to observe attacker behavior. On Saturday, October 17, the blogger reported seeing in-the-wild exploitation using exploit code from ZM’s GitHub repository. The first payload delivered was a cryptocurrency miner.
What should you do?
Users should verify their current Plex Media Server version immediately to ensure they are running 1.43.3.10861 or later. Those on older versions should apply the August security update without delay. Network administrators should monitor for unusual outbound traffic that may indicate proxy software or cryptocurrency mining activity on their devices.
What to do and how to stay safe: Plex Media Server
- Check your Plex Media Server version and update to 1.43.3.10861 or newer if you are running an older build.
- Review server logs for unauthorized file creation or execution attempts, particularly around video transcoding events.
- Ensure your Plex server is not directly exposed to the internet without additional network security controls.
- Monitor network traffic for unexpected connections to cryptocurrency mining pools or residential proxy networks.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the Plex2Shell vulnerability?
Plex2Shell is an unauthenticated remote code execution chain that allows attackers to gain admin access and run code on vulnerable Plex Media Servers.
Which Plex versions are vulnerable?
Plex Media Server versions prior to 1.43.3.10861 are affected by the four CVEs involved in this exploitation chain.
Has this vulnerability been exploited in the wild?
Yes, researchers confirmed active exploitation on October 17, with attackers installing cryptocurrency miners on honeypot servers.
