Attackers chain four Plex Media Server flaws to breach servers
Owners of unpatched Plex servers face admin token theft and code execution, and federal agencies have a deadline of October 23 to act.
CISA says attackers are actively exploiting four flaws in Plex Media Server, collectively named Plex2Shell, which when chained can let an attacker obtain the owner's admin token and run code with elevated privileges. Federal agencies have been directed to patch or mitigate by October 23. Researcher Zach Main reported the flaws to Plex on July 27 and rates the full chain at 9.8, although the individual issues are rated medium to high. Exploitation reports began October 17, targeting Plex honeypots to deploy a cryptominer, while the technical write-up came out October 16 and a proof-of-concept followed three days later. The affected versions are those before 1.43.3.10861, released August 4. CISA also added a Siemens Software Center flaw (CVE-2026-110936), abused in Romulus ClickFix campaigns, and a SiteGuard WAF command injection flaw (CVE-2026-106931) to its catalog.
Why it matters
The flaws are reported as being exploited in the wild, and the chain can let an attacker take the server owner's admin token and run code with elevated privileges. Individual issues are rated medium to high, while the full chain is rated 9.8, so the risk comes from the combination rather than any single bug. Exploitation began within days of the technical write-up, with early attacks deploying a cryptominer. Anyone running Plex Media Server should expect that versions before 1.43.3.10861 are exposed, and that the patch released on August 4 closes the affected versions.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer