CVE-2026-96656

What is Plex Media Server?

Plex Media Server is self-hosted media library software. It indexes a user's films, television, music, and photos, transcodes them on demand, and streams them to Plex client apps on phones, smart televisions, consoles, and browsers. It runs on Windows, macOS, Linux, FreeBSD, Docker, and most consumer NAS appliances, listening on TCP port 32400, and its remote access feature is designed to make the server reachable from outside the home network.

That combination makes it an attractive target at scale. Plex servers number in the hundreds of thousands on the public internet, they usually sit on residential connections with a clean IP reputation, they are often on unattended hardware that nobody patches, and they commonly have broad read access to a household's file shares. An attacker who gets code execution on one gains a free compute node, a residential proxy exit, and a view of whatever storage the Plex service account can read.

Overview

CVE-2026-96656 is an arbitrary file write in Plex Media Server. The server owner's transcoder preferences accept values that control where the encoder writes output, so a caller holding an owner-level token can place a file of their choosing at a path of their choosing, including the Codecs directory that Plex loads shared libraries from at transcoder startup. Because the planted file is subsequently loaded and executed, the write is a code execution primitive rather than a mere integrity problem.

On its own the flaw needs an admin token, which is why the CVSS v3.1 vector carries PR:H and scores 7.2. Its real significance is as the final stage of the chain the researcher named Plex2Shell. CVE-2026-96652 provides unauthenticated SSRF into the loopback interface, CVE-2026-96654 reaches the internal agent and plugin API through that SSRF, CVE-2026-96655 provides a second arbitrary-host SSRF from the transcoder that leaks the owner's admin token, and CVE-2026-96656 turns that stolen token into a file write and then into execution. End to end, an unauthenticated attacker on the network gets code execution as the Plex service user.

Plex shipped the fix in 1.43.3 on 2026-09-01 and published an advisory with no technical detail, which bought roughly six weeks of quiet. That ended on 2026-10-16 when the researcher published a full write-up and a working proof of concept. Exploitation in the wild began the following morning, and on 2026-10-19 Plex updated its advisory to describe the flaws as actively and widely exploited. CISA added all four to the KEV catalog on 2026-10-20, giving this one a three-day deadline of 2026-10-23.

Affected Versions

Plex states plainly that 1.43.3.10861 and later are not affected, and that any internet-reachable server running an older build should be treated as possibly compromised.

Technical Details

The CWE is CWE-73, external control of file name or path. In plain words, the software lets a caller decide where a file goes instead of deciding that itself and confining the result to a safe directory. Here the attacker-controlled value arrives through the TranscoderH264Options preference, which is writable by the server owner and is passed through to the encoder. A debug option in that pipeline redirects encoder output to an operator-specified path, and nothing constrains that path to a scratch directory.

Execution follows from how Plex starts a transcode. At transcoder startup the server enumerates the configured codec directory and calls dlopen on every .so file it finds, with no check on filename, ownership, permissions, or signature. A shared object's constructor runs the moment it is loaded, so a planted library executes without the attacker needing to trigger anything else. On the researcher's test system the resulting process ran as uid 1000, the Plex service account. On Windows installations the equivalent artefact is a .dll in the Codecs folder.

Attack characteristics for this CVE in isolation: network reachable, low complexity, no user interaction, but high privileges required. Chained with the other three, the privilege requirement disappears, which is the only reason a 7.2 belongs in KEV with a three-day clock.

Discovery

The chain was found by independent researcher Zach Main, who reported it to Plex on 2026-07-27. Plex confirmed the findings on 2026-08-04 and paid a bug bounty. Main held details until 2026-10-16, six weeks after the fix shipped, then published the write-up at zmain.info and the proof-of-concept chain on GitHub under code-zm/plex2shell, along with detection content. The in-the-wild activity that followed was independently captured and documented by BoredHackerBlog.

Exploitation Context

Exploitation is confirmed by the vendor, by honeypot capture, and by CISA's KEV listing. The lag was about 24 hours: the PoC went public on 2026-10-16 and the first exploit attempts landed on the morning of 2026-10-17, which strongly suggests opportunistic actors running the published chain more or less unmodified.

Observed attacker IPs were 45.194.92.222, 91.92.40.202, and 176.65.139.228, with payloads pulled from 217.60.194.116. The requests came from Python-urllib/3.10 and began with a crafted protocol parameter against /player/timeline/subscribe, pointing the server at its own loopback agent interface via an attacker-controlled sslip.io hostname. Payloads dropped included an XMRig-based Monero miner and a residential proxy binary named myawesomeproxy that beacons to proxystream.st, plus files named docker and x (the latter UPX-packed). Plex also names processes mylovelyminer and x12345 in its advisory.

Scale is substantial: Shadowserver began daily scans on 2026-09-04 and counted more than 36,000 internet-exposed Plex servers still running 1.43.2 or earlier. No ransomware use and no state-actor attribution have been reported; the motive so far is cryptomining and proxy resale.

Remediation

1. Update Plex Media Server to 1.43.3.10861 or later immediately. Check the running version under Settings > General in Plex Web rather than trusting the package version.
2. Update Plex Desktop to 1.115.0 where it is installed.
3. If remote access is not needed, turn it off, and do not forward TCP port 32400 directly to the internet. Reach the server over a VPN or reverse proxy with authentication instead.
4. Treat any internet-reachable server that ran a build older than 1.43.3.10861 after 2026-10-16 as potentially compromised. Patching does not remove a planted library or a running miner.
5. Hunt for the known indicators: unexpected .so or .dll files in the Codecs folder, processes named myawesomeproxy, mylovelyminer, x12345, xmrig, docker, or x, outbound connections to proxystream.st or to 217.60.194.116, inbound requests to /player/timeline/subscribe from the IPs above, unfamiliar Docker containers, and sustained high CPU while nothing is playing.
6. Inspect Preferences.xml for unexpected transcoder options, in particular a modified TranscoderH264Options value, which is the artefact this CVE leaves behind.
7. If compromise is confirmed or suspected, rebuild from a clean installation rather than cleaning in place, empty the Codecs folder, sign out all devices, change the Plex account password, and treat any file share or credential the Plex service account could reach as exposed.
8. Federal civilian agencies must remediate by 2026-10-23 under BOD 22-01. Given a public exploit chain and mass opportunistic scanning, every operator should patch on the same timescale.