CISA warns of active exploitation of chained Plex Media Server vulnerabilities

white computer keyboard — Sergi Kabrera / Unsplash

The United States Cybersecurity and Infrastructure Security Agency has issued an urgent advisory regarding active cyberattacks that chain four distinct vulnerabilities in Plex Media Server. The agency confirmed that these attacks are currently occurring in the wild, prompting immediate recommendations for security measures to protect affected systems.

The attack campaign, identified as Plex2Shell, allows adversaries to compromise servers without requiring valid login credentials. Attackers exploit internal server functions to steal administrator authentication tokens and subsequently execute malicious code remotely. This method bypasses standard access controls, granting unauthorized control over the media management software.

Plex Media Server is software designed to store and stream personal media, including movies, music, and photos, across multiple devices via the internet. The application is deployed in home environments, network-attached storage devices, and corporate internal systems. Older versions of the server that are exposed to the internet are particularly susceptible to this specific attack vector.

The exploitation relies on a combination of four specific vulnerabilities. CVE-2026-96652 enables external attackers to trick the server into sending abnormal requests to internal systems. CVE-2026-96654 allows access to internal functions to induce commands intended by the attacker. CVE-2026-96655 exposes the server owner's administrator authentication token. Finally, CVE-2026-96656 permits the storage of malicious files within the server to execute code with program execution privileges.

While the individual risk level of each vulnerability is rated between medium and high, the combined effect allows for full server takeover without authentication. Security researchers have assessed the overall risk of the chained attack at 9.8 out of 10. Zach Main, the security researcher who discovered the flaws, reported the issues to Plex on July 27. Technical analysis and attack reproduction code were made public on October 16, which coincided with a spread in actual attack attempts.

Plex has confirmed that widespread attacks are targeting unpatched servers exposed to the internet. Compromised servers have been observed running cryptocurrency mining programs. Additionally, attackers have used the victims' internet connections to relay other traffic. The company advises users to assume that externally accessible vulnerable servers have already been compromised.

The affected products are versions of Plex Media Server prior to 1.43.3.10861. Updates to this version or later include fixes for these vulnerabilities. CISA has directed US federal agencies to complete security updates or mitigation measures by October 23. Security administrators are advised to immediately verify server versions and update to the latest release. They should also restrict unnecessary exposure of port 32400 and inspect for unknown programs or abnormal external communications. If a compromise is suspected, a clean reinstall and password reset are recommended.