Threat actors are exploiting a chain of four vulnerabilities in Plex Media Server, collectively known as Plex2Shell, to deploy cryptocurrency miners and reverse proxy software.
The vulnerability or weakness
The vulnerabilities include CVE-2026-96652 (CVSS score: 5.3), CVE-2026-96654 (CVSS score: 6.9), CVE-2026-96655 (CVSS score: 5.3), and CVE-2026-96656 (CVSS score: 8.6).
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-96651 | 7.1 | HIGH | No | - |
| CVE-2026-96652 | 5.3 | MEDIUM | No | - |
| CVE-2026-96654 | 6.9 | MEDIUM | No | - |
| CVE-2026-96655 | 5.3 | MEDIUM | No | - |
| CVE-2026-96656 | 8.6 | HIGH | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations are at risk of unauthorized access and data breaches, potentially leading to financial losses and operational disruptions.
Industries affected
This issue affects users of Plex Media Server, including individuals, small businesses, and home users.
Users affected
Users could see their systems compromised, leading to the installation of cryptocurrency miners and other malicious software, which can compromise privacy and security.
