The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about four vulnerabilities in Plex Media Server that attackers are actively leveraging in coordinated campaigns. Collectively designated as Plex2Shell, these flaws can be chained together to allow an attacker to extract the server owner's admin token and run arbitrary code with elevated privileges.

Plex Media Server is a widely used platform that enables users to catalog and manage personal libraries of films, television series, music and photographs, then stream this content to devices within a home network or remotely across the internet.

CISA has mandated that federal agencies either patch systems vulnerable to Plex2Shell or implement workarounds no later than October 23.

Security researcher Zach Main discovered the flaws and submitted them to Plex through responsible disclosure on July 27. While each individual vulnerability carries a medium or high severity rating, the complete exploit chain receives a critical severity score of 9.8.

The four vulnerabilities are:

  • CVE-2026-96652 – An SSRF vulnerability in the /player/timeline endpoint permitting unauthenticated attackers to direct Plex to transmit POST requests to any destination, including its own internal APIs.
  • CVE-2026-96654 – A URL injection flaw in the searchOne function that grants attackers the ability to trigger other plugins' functions using attacker-supplied parameters.
  • CVE-2026-96655 – An authenticated SSRF vulnerability in the transcoder endpoint enabling users to force Plex to request arbitrary internal or external addresses.
  • CVE-2026-96656 – An arbitrary file write vulnerability in transcoder settings that permits administrators to inject malicious shared libraries that Plex loads subsequently, resulting in code execution.

Main disclosed the full technical details of Plex2Shell on October 16, with a working proof-of-concept exploit following on October 19. Active exploitation in the wild commenced on October 17, with initial attacks targeting Plex honeypots to install cryptocurrency mining software.

Tweet

The vulnerability affects Plex Media Server releases prior to version 1.43.3.10861, which became available on August 4.

Siemens and SiteGuard vulnerabilities also under active attack

CISA has simultaneously added two additional vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-110936 is an uncontrolled search path element flaw in Siemens Software Center that Siemens disclosed on October 19 as being exploited in active campaigns. The attacks are associated with Romulus, a multi-payload ClickFix delivery framework.

According to analysis from operational technology security firm Forescout, Romulus "may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators."

Siemens has published indicators of compromise and guidance for identifying affected systems, recommending that administrators upgrade Siemens Software Center to version 4.0.9.8 or later.

CISA also added CVE-2026-106931 to the KEV list, an OS command injection flaw impacting the SiteGuard Server Edition web application firewall (WAF). Both the vendor and Japan's CERT reported this vulnerability as actively exploited in late October.

The vendor has instructed users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.