CISA Warns Hackers Are Exploiting Plex2Shell Flaws to Compromise Plex Media Servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that attackers are actively exploiting four vulnerabilities in Plex Media Server.

Known collectively as Plex2Shell, the vulnerabilities can be chained to obtain a Plex owner’s administrator token and execute code with elevated privileges. Researchers rated the complete exploit chain as critical, with a CVSS score of 9.8, even though the individual flaws range from medium to high severity.

Plex Media Server is a popular media suite that lets users organize and stream personal collections of movies, TV shows, music, and photos to devices at home or remotely over the Internet.

CISA has directed federal agencies to prioritize affected systems by applying patches or mitigations by October 23.

Four vulnerabilities make up the Plex2Shell attack chain

Security researcher Zach Main discovered the issues and reported them to Plex on July 27. The vulnerabilities involved in the Plex2Shell chain are:

• CVE-2026-96652: A server-side request forgery (SSRF) flaw in /player/timeline that allows unauthenticated attackers to make Plex send POST requests to arbitrary destinations, including its own internal API.
• CVE-2026-96654: A URL injection flaw in searchOne that allows attackers to call functions in other plugins using attacker-controlled parameters.
• CVE-2026-96655: An authenticated SSRF flaw in transcoder endpoints that allows users to make Plex send requests to arbitrary internal or external addresses.
• CVE-2026-96656: An arbitrary file-write flaw in the transcoder configuration that allows administrators to plant a malicious shared library. Plex then loads the library and executes its code.

Zach Main has published complete technical details of Plex2Shell. The vulnerability was discovered on October 16, and a proof-of-concept (PoC) exploit was conducted three days later.

Plex2Shell attacks observed in the wild

Reports of Plex2Shell being exploited in the wild began emerging on October 17. The attacks initially targeted Plex honeypots and deployed cryptominers.

Update Plex Media Server to block the exploit chain

Plex2Shell affects Plex Media Server versions older than 1.43.3.10861, which was released on August 4. Plex administrators should update affected installations or apply the mitigations recommended by the vendor and CISA.

Hackers also target Siemens Software Center

CISA has also added a vulnerability affecting Siemens Software Center (SSC) to its Known Exploited Vulnerabilities (KEV) catalog.

Tracked as CVE-2026-110936, the flaw is an uncontrolled search path element defect in Siemens Software Center. The German technology giant issued a warning on October 19, stating that hackers were exploiting the vulnerability in a campaign linked to Romulus, a multi-payload ClickFix distribution platform.

Recent research from operational technology cybersecurity company Forescout said Romulus could be a privately operated panel, a commercial cybercrime distribution service, an affiliate framework, or software copied between operators.

Siemens’ alert for CVE-2026-110936 includes indicators of compromise (IoCs) and guidance for identifying compromised systems. Administrators are urged to update Siemens Software Center to version 4.0.9.8 or later.

CISA adds SiteGuard Server Edition flaw to KEV

CISA also added CVE-2026-106931 to its KEV catalog. The vulnerability is an OS command injection flaw affecting SiteGuard Server Edition Web Application Firewall (WAF).

Both the vendor and Japan’s CERT reported that CVE-2026-106931 was being actively exploited late last week.

Vendors urge users to upgrade to the following versions or later:

• SiteGuard Server Edition for Apache httpd and Nginx: version 8.00 Update 5
• SiteGuard Server Edition for IIS: version 8.00 Update 5
• SiteGuard Server Edition for Apache httpd and Nginx for FreeBSD: version 7.00 Update 6

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report