CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
CISA warns of Plex2Shell vulnerabilities in Plex Media Server, affecting versions before 1.43.3.10861. Hackers exploit four vulnerabilities to obtain admin tokens and execute code with elevated privileges.
Intelligence analysis by Qwen 2.5 (3B)
CISA alerts about Plex2Shell vulnerabilities in Plex Media Server, which can be exploited to gain admin access and execute code with elevated privileges.
Plex is a tool that lets people organize and watch movies, TV shows, and music. Hackers found four ways to break into Plex and take control of it. CISA told people to fix their Plex to stop the hackers.
Analysis
{"heading_1":"Plex2Shell Vulnerabilities","subheading_1":"Plex2Shell Overview","content_1":"Plex2Shell is a set of four vulnerabilities discovered in Plex Media Server, a popular media suite used for organizing and streaming media. The vulnerabilities are collectively rated from medium to high severity.","subheading_2":"Vulnerability Details","content_2":"CVE-2026-96652: An SSRF flaw in /player/timeline allows attackers to send POST requests to arbitrary destinations, including internal APIs. CVE-2026-96654: A URL injection flaw in searchOne enables attackers to invoke other plugins' functions with attacker-controlled parameters. CVE-2026-96655: An authenticated SSRF flaw in the transcoder endpoint allows users to request arbitrary internal or external addresses. CVE-2026-96656: An arbitrary file write flaw in the transcoder settings enables administrators to load malicious shared libraries, leading to code execution.","subheading_3":"CISA's Response","content_3":"CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23. The vulnerabilities were discovered by security researcher Zach Main and reported responsibly to Plex on July 27. CISA has added two more vulnerabilities to its Known Exploited Vulnerability (KEV) catalog: CVE-2026-110936 in Siemens Software Center and CVE-2026-106931 in SiteGuard Server Edition web application firewall (WAF)."}
Key points
- CISA warns of Plex2Shell vulnerabilities in Plex Media Server
- Plex2Shell affects versions before 1.43.3.10861
- Vulnerabilities include SSRF, URL injection, authenticated SSRF, and arbitrary file write flaws
- CISA advises federal agencies to patch affected systems by October 23
- Two additional vulnerabilities were added to the Known Exploited Vulnerability catalog
Plex users can take steps to secure their systems, such as keeping their software up to date and avoiding suspicious links or downloads.
If Plex users don't patch their systems, hackers could use the vulnerabilities to take control of their media servers and potentially steal data or cause other damage.
