PolicyCortex
Request Access
Summary
  • CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to the KEV catalog on October 20, 2026, citing active exploitation.
  • Each flaw alone scores medium or high. The researcher who found them rates the full chain as critical.
  • Plex Media Server 1.43.3.10861 and later is fixed. Older builds that faced the internet should be treated as possibly compromised.
  • Chained exploits punish patch plans that rank by single scores. Fix the chain, then prove the fix.

A forgotten server becomes the attacker's server

Somebody set up a Plex Media Server two years ago. It streams movies to the family room. It also faces the internet through an old port forward nobody remembers.

On October 20, CISA added four of its flaws to the Known Exploited Vulnerabilities catalog. CISA is the Cybersecurity and Infrastructure Security Agency. The catalog lists flaws that attackers are actively exploiting.

That forgotten server is now a target.

What CISA confirmed on October 20

CISA listed CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 as actively exploited. Security researcher Zach Main reported the flaws to Plex in July. Plex shipped the fix in build 1.43.3.10861 and urged updates on September 1.

Public exploit code appeared on October 16. A researcher running a decoy server recorded real attacks the next day. The payloads were a cryptocurrency miner and proxy software that rents out the victim's internet connection. CISA told federal agencies to patch or mitigate by October 23.

How four flaws become one attack

Step one needs no login. A crafted request to the player timeline endpoint tricks Plex into sending web requests the attacker chooses. That is CVE-2026-96652.

Step two steals the crown jewels. A crafted search value reaches internal functions and pulls back data that includes the server owner's admin token. That is CVE-2026-96654.

Step three plants a file. With the stolen token, the attacker uses the transcoder to write a file to a chosen path. That is CVE-2026-96655 and CVE-2026-96656.

Step four runs it. Plex loads unsigned files from its Codecs folder as code. The attacker now runs code with the server's privileges.

Why the scores lied to you

Each flaw alone scores medium or high. The highest single score is 8.6 for CVE-2026-96656. The researcher who found the chain rates the full combination as critical.

Patch lists sorted by score hide this. A team working down from 9.0 would fix other things first. Meanwhile the chain sits at full strength on an internet facing box.

Score the chain, not the parts.

What patch day misses

Plex says the fix is build 1.43.3.10861 or later. It also says an older server that faced the internet should be treated as possibly compromised.

Patching closes the door. It does not evict the intruder. A planted miner keeps running after the update. So does proxy software.

Check for strange processes owned by Plex. Check the Codecs folder for unknown files. Check transcoder settings you did not make. If you cannot rule out a breach, rebuild the server from a clean base.

Which compliance rules does this touch?

NIST is the National Institute of Standards and Technology. Its control catalog is NIST SP 800-53 Revision 5.

Flaw repair is control SI-2 in that catalog. In NIST 800-171, it is practice 3.14.1. Both ask you to find flaws, fix them, and prove the fix. Plex2Shell is the case for doing all three fast.

Malicious code protection is control SI-3 and practice 3.14.2. Monitoring is practice 3.14.6. Both cover spotting the miner and the proxyware after the fact.

Incident work is control IR-4 and practice 3.6.1. A possibly compromised server is an incident, not a ticket.

Defense work adds one hard clock. DFARS is the Defense Federal Acquisition Regulation Supplement. Its clause 252.204-7012 can require a cyber incident report to DoD within 72 hours. It also requires keeping images and logs for 90 days.

What proof should you keep after patch day?

Patch day ends with proof, not hope. Keep the version you ran before and the version you run now. Keep the date and time of the restart. Keep the scan that shows the flaws are gone.

Keep the compromise check too. Record what you looked for and what you found. If you rebuilt the server, keep the rebuild record.

PolicyCortex collects evidence from live Azure configuration and ties each control to the setting that met it. The habit is the same one Plex2Shell demands. Proof from the system itself, not from memory.

Sources

Questions on this record
What is Plex2Shell?
Four flaws in Plex Media Server that attackers chain into remote code execution with no login. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20, 2026.
Which Plex version is safe?
Plex Media Server 1.43.3.10861 and later. Earlier 1.43.3 builds, including 1.43.3.10828, are still affected.
Does patching remove the attacker's access?
No. Patching closes the hole but does not remove planted files or miners. A server that ran an old build and faced the internet needs incident response, not just an update.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. CMMC Phase II Is Suspended: What Defense Contractors Still Have to DoThe Department of War suspended CMMC Phase II on July 13, 2026, but kept Phase I self-assessments, NIST SP 800-171 Rev. 2 enforcement, and DFARS 252.204-7012 obligations in place.7 min
  2. The $507K LOGZONE Settlement: Your SPRS Score Is Now False Claims Act EvidenceDOJ settled with a defense contractor that posted a 110 SPRS score and later received a -170 government assessment. Phase II is paused, but the risk of an unsupported score remains.9 min
  3. CMMC Level 2 Requirements in 2026: The Complete Guide for Defense ContractorsCMMC Phase II is suspended, but the 110-requirement NIST 800-171 Rev. 2 baseline, Phase I self-assessments, and DFARS safeguarding obligations remain active.14 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere