Plex Media Server Vulnerability: A Security Flaw Exposed

Plex, a popular media server management application, faced a significant security threat due to vulnerabilities that could allow unauthorized code execution. A chain of bugs, reported by a security researcher known as ZM, enabled attackers to take over exposed Plex Media Servers and execute malicious code.

The Vulnerability Chain

The identified vulnerability, dubbed Plex2Shell, comprised four distinct flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. This exploit is particularly severe as it allows unauthenticated users to gain access to administrative tokens and run harmful scripts when the server attempts to transcode media files. Affected versions include those prior to 1.43.3.10861.

Chronology of Events

On July 27, 2026, ZM reported these vulnerabilities to Plex, and the company acknowledged the threat shortly thereafter. By August 4, Plex had issued a security patch and awarded ZM a $500 bug bounty. However, the payout drew criticism from the cybersecurity community, with many highlighting the inadequacy of the reward given the severity of the vulnerabilities.

By September 1, Plex had published a public advisory urging users to update their servers. It was reported that as of mid-October 2026, around 49,000 vulnerable servers were still exposed, with notable concentrations in North America and Europe.

In-the-Wild Exploitation

An anonymous security enthusiast operated a honeypot using an outdated Plex server to monitor for real-world exploitation of the identified vulnerabilities. The attacker successfully deployed a cryptocurrency miner and a tool known as myawesomeproxy, allowing illicit routing of internet traffic through compromised networks.

Where are the other zero’s 😂😂🤷

— nich0laus 🎭 (@nicl4ssic) October 18, 2026

Call to Action from Security Experts

Nick Percoco, Kraken’s Chief Security Officer, warned users via social media: “If you run Plex at home, update it today. The payload resides in Plex’s Codecs folder and executes every time a video is transcoded, meaning that simply terminating the miner doesn’t prevent future occurrences.”

A History of Plex Security Issues

Plex has experienced various security incidents in the past. Notably, in September 2025, it was revealed that unauthorized individuals accessed user emails, usernames, and hashed passwords, prompting a call for password resets. A prior bug in the software led to restrictions on server access when vulnerabilities were still prevalent. However, no such restrictions were enforced following the disclosure of the current vulnerabilities.

The potential repercussions of running vulnerable Plex servers have been underscored further by previous incidents, such as a major breach involving LastPass in which exploits in third-party software packages, potentially linked to Plex, allowed for severe data breaches and malware implantation.

Conclusion

In light of these ongoing vulnerabilities and the proliferation of unpatched servers, users are strongly advised to update their Plex software immediately to safeguard their systems against potential threats. Regular updates and vigilance are crucial in protecting personal and sensitive information in an era of increasing cyber threats.