Plex2Shell: four-flaw Plex Media Server chain gives unauthenticated RCE (CVE-2026-96652/96654/96655/96656)
Severity: critical · Patch status: patched · Since 2026-09-01 · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Plex2Shell is a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Plex's own security update, dated 2026-10-19, says that chained together the flaws let an unauthenticated remote attacker run code with the Plex process's privileges, and that they are being actively and widely exploited. The researcher Zach Main reported them to Plex on 2026-07-27 and published a full write-up and a public proof of concept on 2026-10-16. One researcher's honeypot recorded in-the-wild exploitation on 2026-10-17, with a cryptominer and a proxy payload. CISA added all four CVEs to KEV on 2026-10-20, with federal due dates of 2026-10-23 for two of them and 2026-11-03 for the other two. The vulnerable product is Plex Media Server on every platform, not only QNAP NAS: QNAP's 2026-11-06 notice reports that some customers' NAS installs appeared compromised and says QTS and QuTS hero are not themselves affected. The fix is Plex Media Server 1.43.3.10861 or later, which Plex says is not affected. Updating does not remove payloads already installed, so an internet-reachable server that ran 1.43.2 or earlier should be treated as possibly compromised: check it, reset its credentials, and disable remote access or move it behind a VPN.
What to do
- Update Plex Media Server to 1.43.3.10861 or later (QNAP NAS: from the QNAP App Center; Windows and macOS: automatic update or the Plex Downloads page)
- Treat any internet-reachable Plex server that ran 1.43.2 or earlier as possibly compromised (both Plex and QNAP say so); updating does not remove payloads already installed
- Check for compromise with Plex's forum guidance (unexpected processes started by the server, unfamiliar .so or .dll files in the Codecs folder, outbound connections, high CPU use while idle) and QNAP's FAQ for NAS-specific steps; the QNAP notice itself lists no indicators of compromise
- If compromise is found or cannot be ruled out, rebuild from a clean install rather than reusing the old data directory, sign out all Plex devices, change the Plex password, and rotate credentials the Plex service account could reach
- Disable Plex Remote Access and do not forward port 32400; use a VPN for remote access
- If compromise is suspected, preserve the Plex Logs folder and send it to QNAP technical support
Fixed versions
Sources
All live incidents on Threat Watch
