Four chained Plex bugs reach unauthenticated RCE, now exploited

Four Plex Media Server bugs that chain into unauthenticated remote code execution are now in CISA’s Known Exploited Vulnerabilities catalog. CISA added them Tuesday after a report from the researcher known as boredhackerblog that attackers are weaponizing the flaws to drop cryptocurrency miners and proxy malware.

The set is called Plex2Shell. Security researcher Zach Main discovered and reported it. No single flaw is dramatic on its own; the highest CVSS score in the group is 8.6. Chained together, they let a remote attacker who has never authenticated reach code execution on the host.

The four pieces:

• CVE-2026-96652 (CVSS 5.3): server-side request forgery
• CVE-2026-96654 (CVSS 6.9): improper neutralization of encoded URI schemes in a web page
• CVE-2026-96655 (CVSS 5.3): a second server-side request forgery
• CVE-2026-96656 (CVSS 8.6): external control of a file name or path

The two SSRF bugs let the server be coaxed into making requests an outside caller shouldn’t be able to trigger. The encoded-URI-scheme handling flaw is the kind of parsing weakness that lets input survive validation and be interpreted later as something it isn’t. The file name and path control bug hands an outside caller influence over a path the server acts on. According to Main, stringing all four together is what gets you to unauthenticated RCE; the individual scores don’t reflect that, which is exactly why a scored-low SSRF is worth patching anyway.

Plex fixed the issues in Plex Media Server 1.43.3.10861, released on August 3, 2026. The patch has been available for over two and a half months, and exploitation is now in the wild, so the window where updating was precautionary has closed.

If you run a Plex server, update to 1.43.3.10861 or later. This matters more for Plex than for most enterprise software because the typical deployment is a self-hosted box on a home or small-office network, often with the web interface reachable from the internet, run by someone who doesn’t track CVE feeds. The payloads reported so far, miners and proxy malware, fit that: the value in the box is its compute and its network connection, not whatever sits on it. A miner tends to show as CPU load and proxy malware as outbound connections, so treat any box that was exposed and unpatched between early August and now as suspect.

CISA flagged two other actively exploited vulnerabilities in the same batch. CVE-2026-110936 (CVSS 8.4) is a DLL sideloading flaw in Siemens Software Center, abused in ClickFix attacks using a platform called Romulus. CVE-2026-106931 (CVSS 8.5) is a command injection bug in EG Secure Solutions SiteGuard Server Edition; the Japanese vendor confirmed exploitation, with no further detail available.

The KEV deadlines bind Federal Civilian Executive Branch agencies, but they’re a reasonable read on relative urgency for everyone else. CISA wants fixes for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 applied by October 23, 2026, and the rest by November 3, 2026.