Plex Media Server file write exploited via Plex2Shell chain for code execution

CVE-2026-96656 is an external control of file path flaw (CWE-73) in Plex Media Server. An admin-level user can use it to write arbitrary files into the transcoder Codecs directory, where they are later executed ^1,3. It scores 7.2 because it requires admin privileges ³. It is the final stage of Plex2Shell, a four-CVE chain found by researcher Zach Main ^3,5. The other three are CVE-2026-96652 (SSRF), CVE-2026-96654 (access to internal agent functions over loopback) and CVE-2026-96655 (admin token disclosure) ¹. Plex says the chain gives an unauthenticated remote attacker code execution with the privileges of the Plex Media Server process ¹. The researcher scores the full chain 9.8 ⁵.

All platforms running builds before 1.43.3.10861 are affected ^1,3. Plex's original 2026-09-01 notice described the affected range as 1.43.2 and earlier. Early 1.43.3 builds such as 1.43.3.10828 are also vulnerable, and Censys counts nearly 8,000 hosts on that build ⁶. Censys sees about 324,000 Plex Media Server hosts, about 44% of them in the US and mostly on residential networks ⁶. Roughly 30% run a vulnerable build ⁶. Under 2% of the vulnerable hosts upgraded in the first three days after the chain went public ⁶. Shadowserver had already reported more than 36,000 exposed, unpatched servers in early September ¹¹.

This was not a zero-day. The fixed build shipped in early August ^3,6, and Plex announced the update on 2026-09-01, about six weeks before attacks began ¹. The researcher's write-up and PoC went public on 2026-10-16 ^5,6. On 2026-10-17, an independent honeypot operator recorded the first real exploitation. The traffic came from three source IPs, a fourth host served downloaded files, and the operator then saw an XMRig miner and a proxy tool named myawesomeproxy ⁷. SecurityWeek and The Hacker News report the same miner and proxy payloads ^8,9. On 2026-10-19, Plex said the flaws are being actively and widely exploited, with compromised servers used for mining and for routing third-party traffic ¹.

CISA added the CVE to KEV on 2026-10-20 and requires forensic triage ². BleepingComputer reports that CISA warns all four chain CVEs are exploited ¹⁰. No source attributes the activity to a named threat actor, and KEV lists ransomware use as unknown ². The only public first-hand telemetry is a single honeypot, so its view of the campaign may be partial ⁷.

The flaw sits in the H.264 transcoder options preference (TranscoderH264Options). The server appends that value, unchanged, to the x264 encoder options on every transcode ³. An admin can abuse this to make the server write arbitrary files into the Codecs directory ^1,3. Code execution depends on a second weakness. Plex loads .so files at transcoder startup with no signature, execute-bit or symbol check, so a planted file runs the next time it is loaded ^3,6.

Used alone, the bug requires owner or admin privileges. It is reachable over the network and needs no user interaction ³. In the Plex2Shell chain, the three earlier CVEs supply that admin access. Any internet-reachable server on an unpatched build is therefore exposed to unauthenticated attackers ⁶. Plex warns that internet-reachable servers on builds older than 1.43.3.10861 may already be compromised ¹. Plex recommends against directly forwarding port 32400 ¹.

Patching closes the chain, but Censys notes it leaves any implant already planted in the Codecs directory in place and does not invalidate an admin token that was already leaked ⁶. Servers that were exposed on a vulnerable build since 2026-10-16 still need checking after the upgrade ^1,6.

1. 1

   Upgrade Plex Media Server to 1.43.3.10861 or newer ^1,3. Windows and macOS servers update automatically only if automatic updates are enabled. Linux, NAS and Docker installs must be updated manually ^1,6.

2. 2

   US federal agencies must meet the KEV due date of 2026-10-23. That means applying vendor mitigations in line with BOD 26-04 and the Forensics Triage Requirements, or discontinuing the product if mitigations are unavailable ².

3. 3

   Turn off Remote Access (Settings > Remote Access) where it is not needed ¹. Avoid forwarding port 32400 directly to the internet ¹.

4. 4

   Plex says to assume an internet-reachable server on a build older than 1.43.3.10861 may be compromised ¹. Upgrading does not remove implants or revoke exposed tokens ⁶. If compromise is found or cannot be ruled out, rebuild from a clean install rather than reusing the old data directory ¹.

5. 5

   If you cannot rebuild immediately, take these minimum steps from Plex ¹: - Delete everything in the Codecs folder. - Check Preferences.xml for transcoder options you did not set. - Sign out all devices. - Change the Plex account password.

6. 6

   Consider every resource the Plex service account had access to as exposed, such as network shares mounted on the host and secrets kept on the same machine or VM ¹. Rotate those credentials and review access to those shares.

• Inventory versions under Settings > General in Plex Web. Any build below 1.43.3.10861 is vulnerable ¹. A bare "1.43.3" is not sufficient, because 1.43.3.10828 is still affected ⁶.
• Check the Plex Codecs folder for unfamiliar .so or .dll files ¹. Plex published no specific filenames, so defenders will need to baseline the folder themselves, for example against a clean install of the same build.
• Review Preferences.xml for transcoder options you did not set ¹. Pay particular attention to the H.264 transcoder options value, which is the injection point ³.
• Hunt in EDR or process telemetry for unrecognized children of Plex Media Server, such as myawesomeproxy, mylovelyminer or x12345 ¹. Also flag sustained high CPU while nothing is playing ¹.
• Search DNS, proxy and firewall logs for proxystream.st ¹. The Hacker News reports the subdomain ota.proxystream.st as the miner's mining server ⁹. Add the honeypot IPs and hashes as lower-fidelity indicators, since they reflect one sensor only ⁷.
• Find hosts exposing TCP 32400 to the internet, including NAS devices and Docker hosts ¹. Network owners can check Shadowserver's daily unpatched-Plex reports, issued since 2026-09-04 ¹¹.
• The honeypot operator published pcaps for signature work and links to a detection folder in the researcher's Plex2Shell GitHub repository ⁷. VulnDigest has not reviewed either, so validate them before use.

1. Jul 14, 2026

   Plex Media Server 1.43.3.10828 released; Censys later reports this early 1.43.3 build is still vulnerable. ⁴

2. Jul 27, 2026

   Zach Main reports the Plex2Shell chain to Plex. ⁵

3. Aug 4, 2026

   Plex acknowledges the report and pays a bounty. ⁵

4. Aug 4, 2026

   Fixed build 1.43.3.10861 released, per Censys (CISA's CSAF advisory lists 2026-08-03). ⁶

5. Sep 1, 2026

   Plex announces the security update, without CVE IDs, and urges owners to update. ¹

6. Sep 23, 2026

   CVEs published; CISA issues CSAF advisory VA-26-266-01. ³

7. Oct 16, 2026

   Researcher publishes the technical write-up and PoC. ⁶

8. Oct 17, 2026

   First in-the-wild exploitation seen on a honeypot; miner and proxy payloads dropped. ⁷

9. Oct 19, 2026

   Plex updates its notice with CVE details and confirms active, widespread exploitation. ¹

10. Oct 20, 2026

    CISA adds CVE-2026-96656 to KEV with forensic triage required. ²

11. Oct 23, 2026

    KEV remediation due date for US federal agencies. ²

1. 1
   Important Security Update for Plex Media Server v1.43.2 and earlier

   Plex · Vendor · Oct 19, 2026
2. 2
   CISA KEV entry for CVE-2026-96656

   CISA · Government · Oct 20, 2026
3. 3
   CISA CSAF VA-26-266-01 Plex Media Server

   CISA · Government · Sep 23, 2026
4. 4
   Plex Media Server release announcement (1.43.3.10828)

   Plex · Vendor · Jul 14, 2026
5. 5
   Plex2Shell

   Zach Main (zmain.info) · Research · Oct 16, 2026
6. 6
   October 20 Advisory: Plex Media Server Remote Code Execution Chain

   Censys · Research · Oct 20, 2026
7. 7
   Plex vulnerabilities being exploited in the wild to drop a cryptominer

   boredhackerblog (independent researcher) · Research · Oct 17, 2026
8. 8
   Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

   SecurityWeek · News · Oct 19, 2026
9. 9
   Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

   The Hacker News · News · Oct 19, 2026
10. 10
    CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

    BleepingComputer · News · Oct 21, 2026
11. 11
    Over 36,000 exposed Plex servers vulnerable to recent flaws

    BleepingComputer · News · Sep 9, 2026