Loading story…
Plex has released Media Server version 1.43.3.10861 to fix five vulnerabilities, and South Korea’s KISA has urged users of earlier versions to upgrade. The flaws—CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656—cover path traversal, server-side request forgery (SSRF), URL injection and arbitrary file writing. CVE-2026-96652 lets an attacker supply any Plex token value and direct a server-generated request to a chosen destination; CVE-2026-96655 allows authenticated users to request arbitrary internal or external addresses. CVE-2026-96654 permits network-based invocation of other plugins’ functions with attacker-controlled parameters, without privileges or user interaction. The highest-rated flaw, CVE-2026-96656, carries a CVSS v4.0 score of 8.6 and allows an administrator to manipulate transcoder settings to write arbitrary files that may subsequently execute.
A proposed Nuclei detection template targets CVE-2026-96652, while a separate blog presents a purported weaponized Plex2Shell implementation referencing four of the patched vulnerabilities. Its author claims detection evasion and encrypted, in-memory command-and-control capabilities, but the supplied material does not independently verify those capabilities, its estimate of more than 680,000 exposed servers, or exploitation in the wild. Organizations should upgrade all affected Plex Media Server instances to 1.43.3.10861 or later, prioritize internet-accessible deployments and review administrative access. The differing access requirements matter: the arbitrary-file-write flaw requires administrator privileges, even though other weaknesses are reachable with fewer prerequisites.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
A pull request associated with alex700 proposed a Nuclei detector for CVE-2026-96652, with laboratory verification reporting successful assertions and cleanup. A subsequent commit left the code template unsigned for upstream signing; the excerpt does not establish that the detector was merged.
Plex released Media Server version 1.43.3.10861 to address CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. KISA's advisory recommends upgrading affected installations to that version or later.
CISA published CVE-2026-96656, which allows an administrator to write arbitrary files through the TranscoderH264Options preference, potentially leading to execution when loaded. The record describes Plex loading .so files at startup without signature, execute-bit, or symbol checks and assigns a CVSS 4.0 score of 8.6.
CISA disclosed an SSRF vulnerability allowing an authenticated Plex Media Server user to request arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. The vulnerability received medium-severity ratings.
CISA published a medium-severity vulnerability involving improper neutralization of URL values in searchOne. The flaw allows an attacker to invoke other plugins' functions with attacker-controlled parameters, without authentication or user interaction.
On September 23, 2026, CISA published details of an SSRF vulnerability in Plex Media Server's /player/timeline endpoint. An attacker can supply a full URL through the protocol parameter to direct a server-side POST request to an attacker-chosen destination.
An author identifying as @J4ck3LSyN offered plex2shell-wz, an obfuscated reimplementation of the Plex2Shell chain referencing CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The post claims detection evasion and an encrypted two-stage, in-memory command-and-control beacon, but provides no independent verification or evidence of exploitation in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceboho.or.kr
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcejackalsyn.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Plex has urged users to immediately update **Plex Media Server** and **Plex Desktop** to address multiple undisclosed security vulnerabilities. The affected Media Server releases are version **1.43.2 and earlier**; Plex issued Media Server **1.43.3** and Plex Desktop **1.115.0** as the remediated versions and has requested CVE assignments. Plex has not disclosed technical details of the flaws, leaving defenders with limited information while increasing the risk that attackers could reverse-engineer the updates to identify vulnerable systems. Organizations running Plex on NAS devices should verify availability through their vendor package manager and manually install the updated server package where the vendor has not yet published it.
Sep 10, 2026
Plesk disclosed and patched **CVE-2026-44962**, a critical privilege-escalation flaw in **Plesk on Linux** that allows a low-privileged authenticated user to execute arbitrary operating system commands on affected servers. The bug stems from an **XPath injection** issue in the **APS Application Catalog** search function, where unsanitized input is inserted into XPath queries, enabling remote exploitation without user interaction. The vulnerability carries a **CVSS 10.0** rating and can lead to administrative access and full compromise of server resources, with particular risk for shared hosting and other multi-tenant deployments. Plesk released fixes in versions **18.0.76.2** and **18.0.75.1**, and advised administrators to update immediately. For systems that cannot yet be patched, the company said the **APS subsystem** should be disabled through the `panel.ini` configuration file and management components restarted. The flaw was responsibly disclosed by **Georgii Shutiaev**, and reports said there was no public evidence of active exploitation at the time of publication, though defenders were urged to review access controls and monitor for suspicious command execution.
Jun 1, 2026
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Oct 20, 2025