Our takeCISA added four actively exploited vulnerabilities in Plex Media Server to the KEV catalog: CVE-2026-96652 (SSRF), CVE-2026-96654 (URI scheme neutralization), CVE-2026-96655 (SSRF via transcode path), and CVE-2026-96656 (external control of file name or path). These chain together into Plex2Shell. Patch or isolate now.Security Resilience desk
Sources (7)
- cisa_kev · cisa_kev
- cisa_kev · cisa_kev
- cisa_kev · cisa_kev
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- hackernews · hackernews
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA added four actively exploited Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) that chain together for arbitrary file writes and SSRF. Update to the latest version or disable remote access immediately.
What this means for you — Lean IT orgs:If you run Plex Media Server, update it right now — these four chained flaws are already being exploited in the wild and can let attackers write and run files on your server.
What this means for you — MSP:Four chained, in-the-wild Plex Media Server vulnerabilities (CVEs 2026-96652/54/55/56) allow SSRF and arbitrary file writes. Check every client instance for unpatched versions and update or isolate them.
What this means for you — Researcher:CISA KEV listing confirms active exploitation of the four Plex Media Server chain (CVEs 2026-96652, 96654, 96655, 96656). Public PoC already circulating; patch or air-gap immediately.