GajShield Threat Advisory — Plex2Shell Remote Code Execution in Plex Media Server (CVE-2026-96652, -96654, -96655, -96656)

Severity: High | Priority: 1

Plex2Shell is a chain of four vulnerabilities in Plex Media Server v1.43.2 and earlier. Together they let an attacker with no valid account run code on the server as the Plex service user. Many Plex servers are exposed directly to the internet on TCP port 32400. CISA has added the flaws to its Known Exploited Vulnerabilities catalog.

The chain works in four stages:

1. A request to Plex’s companion player endpoint passes a token check that only tests whether a header is present.
2. That request makes the server call its own plugin interface over loopback.
3. A plugin function then leaks the server owner’s admin token to the attacker.
4. With that token, the attacker changes transcoder settings to write and load a malicious library.

Attackers seen exploiting the chain have installed the XMRig cryptominer and a proxy tool (myawesomeproxy). The proxy tool lets them route other people’s traffic through the victim’s internet connection, which is often a home connection.