Why CISA Gave Federal Agencies Three Days to Patch a Batch of Medium Severity Plex Bugs
Exploit code went live on a Friday. By Saturday morning, attackers were already inside Plex Media Servers, mining crypto and routing strangers’ traffic through other people’s home connections. Three of the four bugs are rated medium. The fourth is high, and it only works because the other three get there first.
What Happened?
27 July: Researcher Zach Main reports four flaws to Plex. The fix shipped in build 1.43.3.10861 on 3 August, and Plex told every server owner to update on 1 September. Then the clock started. Working exploit code went public on 16 October. An internet-facing honeypot recorded live exploitation the next morning. Plex confirmed active and widespread exploitation on 19 October. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on 20 October, with three days to patch two of them.
What’s the Impact?
Three of the four flaws are rated medium. The fourth, CVE-2026-96656, is high: 7.2 on CVSS v3.1 and 8.6 on v4. That one requires admin access, and the three medium vulnerabilities hand over admin access. Chained in order, they give an attacker code execution with no login, running with the same privileges as the Plex service. EPSS, the model that predicts exploitation, sat under 1 % for all four as of 21 October, while the attacks ran.
IOCs: Indicators of Compromise
Plex2Shell: published indicators
Everything below comes from Plex’s own security advisory or from the researcher honeypot that first recorded exploitation. Nothing here is inferred or reconstructed.
Process names Source: Plex advisory
Network Sources: Plex advisory, honeypot
File hashes, SHA256 Source: honeypot report
Host artefacts Source: Plex advisory
- Rebuild from a clean install rather than reusing the old Plex data directory. At minimum, clear the Codecs folder and audit Preferences.xml.
- Sign out of all devices from the Plex account and change the password.
- Treat everything the Plex service account could reach as exposed, including mounted shares and any credentials on the same host.
- Turn off remote access and stop forwarding port 32400 unless you need it.
Affected: Plex Media Server before 1.43.3.10861 · Fixed: 1.43.3.10861 and later
CVE-2026-96652 · CVE-2026-96654 · CVE-2026-96655 · CVE-2026-96656 · all on CISA KEV since 20 Oct 2026
Compiled 22 October 2026 from the Plex security advisory and the public honeypot report.
How to Avoid This
- Update Plex Media Server to 1.43.3.10861 or newer today
- Turn off remote access and stop forwarding port 32400 unless you need it
- Check the Codecs folder for files you did not put there
- Rebuild a suspect server instead of reusing its old data directory
- Inventory the hosts nobody owns: NAS boxes, media servers, home labs
A Medium Score on an Exposed Box Beats a Critical One Behind the Firewall
Score-based triage would have parked three of the four, and the fourth only matters because those three unlock it. Exposure and exploitation evidence would not. That gap is the whole story, and Secure.com was built to close it.
- Attack paths start from internet-facing assets carrying known exploited vulnerabilities, not from whatever sits highest on a severity list
- The Vulnerabilities module shows EPSS score, percentile, and exploit evidence for every CVE, side by side
- KEV, EPSS, and exposure are read together, so a medium on a reachable host outranks a critical buried behind the firewall
- The Red Teammate proves what an attacker can actually reach; defensive teammates harden it and show the before and after
- Your team sets the rules. AI teammates do the work.
The Takeaway
The payloads were unglamorous: a cryptocurrency miner and proxy software that quietly resells the victim’s internet connection to strangers. No count of compromised servers has been published, and the public evidence so far rests on Plex’s own statement plus one researcher’s honeypot.
Plex2Shell is not really a story about a media server product. It is a story about chains. Four quiet findings, stacked in the right order, produced a result no single score predicted. The biggest risk is estates where a media box or a developer’s home lab never makes it onto a patch queue.
Attack. Harden. Prove. Repeat.