“Plex2Shell”: Chained Vulnerabilities in Plex Media Server Allow Unauthenticated Full Compromise, Federal Deadline Already Passed

Scope: Plex Media Server (all versions prior to the patched release)

Severity: Red

Security researcher Zach Main responsibly disclosed a set of four vulnerabilities in Plex Media Server to the company on July 27, 2026, individually rated medium to high severity but combining into a full attack chain researchers assign a critical score of 9.8. CVE-2026-96652 is a server-side request forgery flaw in the player timeline endpoint that lets an unauthenticated attacker make Plex send POST requests to arbitrary destinations, including its own internal APIs. CVE-2026-96654 is a URL injection flaw that allows attackers to invoke other plugins’ functions with attacker-controlled parameters. CVE-2026-96655 is an authenticated SSRF in the transcoder endpoint. CVE-2026-96656 is an arbitrary file write flaw in transcoder settings that lets an administrator-level attacker plant malicious shared libraries that Plex subsequently loads, achieving code execution. Chained together, an unauthenticated attacker can obtain the server owner’s admin token and execute code with elevated privileges. CISA directed federal agencies to prioritise patching or apply mitigations by October 23, 2026, a deadline that has now passed. Organisations and individuals running Plex Media Server must update to the latest version immediately, and should treat any internet-exposed Plex instance that remains unpatched past this deadline as an urgent priority rather than routine maintenance.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.