The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued strict security warnings regarding cyber attackers exploiting four vulnerabilities in the popular Plex Media Server, in attacks collectively known as Plex2Shell.
Plex2Shell Vulnerability Details and Attack Chain
Security researcher Zach Main discovered these vulnerabilities and reported them to Plex on July 27, before publishing full technical details on October 16, followed by a proof-of-concept (PoC) exploit tool three days later. When chained together, these vulnerabilities allow attackers to obtain the owner's admin token and execute code with elevated privileges. The full exploit chain received a critical severity score of 9.8, and the individual vulnerabilities include:
- CVE-2026-96652: A Server-Side Request Forgery (SSRF) vulnerability in the /player/timeline endpoint that allows unauthenticated attackers to force Plex to send POST requests to arbitrary destinations, including internal APIs.
- CVE-2026-96654: A URL injection vulnerability in searchOne that allows calling other plugin functions with attacker-controlled parameters.
- CVE-2026-96655: An authenticated SSRF vulnerability in the transcoder endpoint that allows requesting arbitrary internal or external addresses.
- CVE-2026-96656: An arbitrary file write vulnerability in transcoder settings that enables administrators to plant malicious shared libraries that the system later loads to execute code.
Government Directives and Immediate Actions
CISA has directed U.S. federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or to implement mitigation measures no later than October 23. These vulnerabilities affect Plex Media Server versions prior to 1.43.3.10861, which was released on August 4. Reports of this chain being exploited in the wild have emerged since October 17, initially targeting honeypots to deploy cryptocurrency mining software.
Other Vulnerabilities in Siemens and SiteGuard Software Centers
In addition to the Plex vulnerabilities, CISA added to its Known Exploited Vulnerabilities (KEV) catalog an uncontrolled search path element vulnerability, tracked as CVE-2026-110936, which affects the Siemens Software Center (SSC). The German tech giant warned on October 19 that attackers were using this vulnerability in campaigns linked to a multi-payload malware delivery platform called Romulus. The agency also listed an OS command injection vulnerability, CVE-2026-106931, affecting the SiteGuard Server Edition web application firewall, which Japanese regulators warned about after observing active exploitation.
Why This News Matters
This development poses a significant risk due to the severity of the Plex2Shell vulnerability chain, which grants full administrative control and code execution on targeted servers, coinciding with widespread exploitation of vulnerabilities in sensitive enterprise software such as Siemens, necessitating immediate system updates to prevent large-scale breaches.