CISA warns of Plex2Shell attacks exploiting Plex servers

CISA says attackers are actively chaining four Plex Media Server vulnerabilities, collectively called Plex2Shell, to steal the owner's admin token and run code with elevated privileges. Federal agencies must patch or mitigate by October 23.

• The full exploit chain is rated critical at 9.8
• Plex Media Server versions before 1.43.3.10861 are affected
• CVE-2026-96652 is an unauthenticated SSRF in /player/timeline
• CISA also added Siemens and SiteGuard flaws to KEV