Plex Media Servers Under Attack: Critical Vulnerabilities Exploited to Install Cryptocurrency Miners and Proxy Software

A critical security alert has been issued for users of Plex Media Servers following the public disclosure and subsequent active exploitation of a chain of four severe vulnerabilities. These combined flaws allow attackers to remotely gain complete control over exposed Plex media servers without requiring any user authentication or password. Publicly available exploit code, released on Friday, October 16, has already been leveraged by malicious actors to install cryptocurrency miners and proxy software on vulnerable systems, turning personal media libraries into unwilling participants in illicit operations.

The Unveiling of a Critical Flaw: Unauthenticated Remote Code Execution

At the heart of this alarming situation are four distinct vulnerabilities, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which collectively achieve unauthenticated remote code execution (RCE). This means an attacker can run arbitrary commands on a target server simply by sending specially crafted requests, without needing to know a username, password, or any other legitimate credentials. Security researcher Zach Main initially reported these vulnerabilities to Plex on July 27, receiving a bug bounty of $500 (approximately €430) for his discovery. His comprehensive analysis and proof-of-concept (PoC) exploit code were made public on October 16, a move that, while intended to raise awareness and prompt patching, immediately triggered widespread malicious exploitation.

The attack vector is remarkably straightforward, targeting Plex servers that are directly exposed to the internet, typically through port 32400. Many users configure their Plex servers for remote access to their personal film and music collections, often by opening a port on their home router and then giving little further thought to the server’s continuous internet exposure. This common setup makes these servers prime targets for automated scans conducted by attackers seeking forgotten or unpatched machines.

A Critical Timeline of Events

The chronology of this vulnerability’s lifecycle underscores the persistent race between security researchers, software vendors, and malicious actors:

• July 27, 2026: Security researcher Zach Main confidentially reports the chain of vulnerabilities to Plex.
• September 1, 2026: Plex, recognizing the severity of the findings, releases a critical security update. Users are strongly advised to upgrade to version 1.43.3.10861 or newer. Notifications are disseminated via official forums and direct email campaigns, emphasizing the urgency of the patch. This mirrors a similar critical patch release in August 2025 for CVE-2025-34158, highlighting Plex’s proactive approach to security once a vulnerability is known.
• September 23, 2026: The four distinct vulnerabilities are officially assigned their respective CVE identifiers: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
• Early September 2026 (approx.): Prior to the public disclosure of the exploit code, the Shadowserver Foundation, a non-profit organization that monitors the internet for security threats, reports identifying over 36,000 Plex servers that were both exposed to the internet and still running unpatched, vulnerable versions. This figure provided a stark warning of the potential scale of compromise.
• October 16, 2026: Zach Main publishes his detailed technical analysis and proof-of-concept exploit code on his blog, providing the technical community with insights into the vulnerabilities.
• October 17, 2026: Within 24 hours of the PoC’s release, a separate security researcher monitoring a "honeypot" (a decoy system designed to attract and study cyberattacks) observes active exploitation attempts using Main’s publicly available code. This rapid weaponization of newly disclosed vulnerabilities is a common pattern in the cyber threat landscape.
• Ongoing: Reports from Plex users and security analysts confirm widespread exploitation, with cryptocurrency miners and proxy software being the primary payloads installed on compromised servers.

The Anatomy of the Attack: Four Chained Flaws

Zach Main’s research revealed a sophisticated chain of four vulnerabilities, each contributing to the attacker’s ability to gain full control:

1. CVE-2026-96652 (Authentication Bypass via Malformed Token): The attack begins by presenting a "fake" or malformed authentication token. Plex’s server, instead of rigorously validating the token’s authenticity, merely checks for the existence of the token field. This lax validation allows the attacker to bypass the initial authentication step, granting them a foothold.
2. CVE-2026-96654 (Server-Side Request Forgery – SSRF): Once the initial bypass is achieved, the attacker exploits an SSRF vulnerability. They force the Plex server to send a request to itself, targeting an internal interface that is ordinarily only accessible to the local machine. This internal interface, designed for inter-process communication or local management, grants elevated privileges that are not intended for external access.
3. CVE-2026-96655 (Privilege Escalation via Metadata Module): With access to the internal interface, the attacker then manipulates the Plex module responsible for retrieving TV series metadata (e.g., show descriptions, episode lists). By exploiting this module, they are able to steal the administrator token, effectively escalating their privileges to that of a full administrator on the Plex server.
4. CVE-2026-96656 (Remote Code Execution via Video Transcoder): Armed with the administrator token, the attacker targets the video transcoder module. They force the transcoder to write a specially crafted, malicious file into the Plex codecs folder. Plex servers automatically load and execute code from this codecs folder during video transcoding operations. This final step allows the attacker to execute arbitrary code on the underlying operating system with the privileges of the Plex user account, achieving full remote code execution.

Zach Main assigned this entire vulnerability chain a maximum severity score of 10 out of 10 on the Common Vulnerability Scoring System (CVSS), reflecting the critical impact of unauthenticated remote code execution. He also noted that his discovery process heavily leveraged artificial intelligence (AI) models, demonstrating the evolving methods in cybersecurity research, albeit with human oversight guiding the critical decisions. This implies that even a relatively unsophisticated attacker performing random internet scans could compromise a server without any prior knowledge of its owner or configuration.

The Digital Battlefield: Active Exploitation and Its Impact

The observed exploitation of these vulnerabilities is primarily focused on resource monetization and network obfuscation:

• Cryptocurrency Mining (Cryptojacking): The most common payload seen thus far is the installation of cryptocurrency mining software, specifically XMRig, which mines Monero (XMR). Monero is a privacy-focused cryptocurrency often favored by illicit actors due to its enhanced anonymity features. When installed, these miners consume significant CPU and GPU resources, causing the compromised server’s fans to run constantly, system performance to degrade, and electricity bills to dramatically increase for the unsuspecting owner. Reports on Plex forums confirm this, with users describing their containers suddenly engaging in mining activities overnight.
• Proxy Software Installation: Beyond cryptomining, some attackers are installing proxy software, such as one observed named "myawesomeproxy." This turns the compromised Plex server into a proxy node, allowing attackers to route their internet traffic through the victim’s residential IP address. This has severe implications:
  • Traffic Obfuscation: Attackers can mask their origins, making it harder for law enforcement or security researchers to trace their activities.
  • Abuse of Residential IPs: The victim’s IP address could be used for illegal or unethical activities, potentially leading to the IP being blacklisted, or even drawing unwanted attention from authorities to the victim’s household. The warning message left by the proxy software on the honeypot explicitly stated that the machine’s internet traffic might be reused, a clear indicator of this intent.

Beyond Cryptomining: The Deeper Risks

While cryptomining and proxy usage are immediate concerns, the underlying remote code execution capability poses much broader and more severe risks. A compromised Plex server could serve as a beachhead for further attacks:

• Data Theft: Depending on where Plex is installed (e.g., a home server, a dedicated NAS, or even a personal computer), an attacker could gain access to other files, personal data, or sensitive information stored on the same machine or accessible on the local network.
• Network Lateral Movement: If the Plex server is part of a larger home or small business network, the attacker could use it as a pivot point to move laterally, attempting to compromise other devices, network shares, or more critical systems.
• Botnet Recruitment: Compromised servers could be enlisted into larger botnets, participating in DDoS attacks, spam campaigns, or other malicious activities, further implicating the victim’s IP address and internet connection.

A historical example underscores this danger: in 2022, the massive data breach suffered by LastPass, a prominent password manager, was reportedly initiated through the personal computer of an engineer. This engineer’s Plex server, running an unpatched version with a vulnerability (CVE-2020-5741, patched in May 2020) that required authenticated access, was exploited. This incident demonstrates how an "insignificant" media server, if left vulnerable, can become the initial entry point for attacks on far more sensitive systems and data. An overlooked media server can indeed become the gateway to much more than just a collection of films.

Plex’s Official Response and Call to Action

Plex acted promptly by releasing the necessary patch on September 1. The official guidance from Plex is unequivocal: users must update their Plex Media Server to version 1.43.3.10861 or any later version.

For users who have automatic updates enabled, their servers might already be protected. However, users of Network Attached Storage (NAS) devices from manufacturers such as Synology, QNAP, Ugreen, or TerraMaster need to exercise particular caution. Updates for Plex on these platforms are often distributed through the manufacturer’s package manager, which can introduce delays in receiving the latest security patches. In such cases, Plex advises downloading the latest server package directly from their official website and installing it manually to ensure the most current protection.

Immediate Steps for Users: Patching and Remediation

Simply updating the Plex Media Server is a crucial first step, but it might not be sufficient if a server has already been compromised before the patch was applied. Malicious files, once installed, can persist even after the vulnerability is patched.

• Verify Your Version: Immediately check the version of your Plex Media Server. If it is older than 1.43.3.10861, update it without delay.
• Post-Compromise Cleanup: If your server was exposed to the internet and running an unpatched version, it is highly probable that it has been compromised. In this scenario, updating alone will not remove the malicious payload. Attackers often install persistent malware, such as the aforementioned cryptocurrency miners or proxy software, which may reside in the Plex Codecs folder. These malicious files (typically .so files on Linux/macOS or .dll files on Windows) can re-launch themselves every time a video is transcoded, even after the initial exploit is patched. Users must manually inspect the Plex Codecs folder for any suspicious files they did not put there and remove them.
• Review System Logs and Resources: Monitor your server’s CPU, GPU, and network usage for unexplained spikes that could indicate unauthorized cryptomining or proxy activity. Review system logs for unusual processes or connections.

Securing Your Digital Fortress: Long-Term Best Practices

The most effective long-term defense against these types of vulnerabilities is to fundamentally re-evaluate how Plex Media Servers are exposed to the internet:

• Avoid Direct Internet Exposure: The strongest recommendation is to avoid exposing your Plex server directly to the internet. A server that is only accessible on the local network is immune to these automated internet scans.
• Utilize a VPN: If remote access is essential, consider implementing a Virtual Private Network (VPN). By connecting to your home network via a VPN, you can access your Plex server securely as if you were physically present on the local network, without opening any direct ports to the public internet. This significantly reduces the attack surface.
• Firewall Rules: Implement strict firewall rules to limit incoming connections to only trusted IP addresses or networks, if direct exposure is unavoidable.

The existence of a patch since September 1 means that any server remaining vulnerable today is primarily due to oversight. Cybercriminals actively exploit this human factor, relying on users neglecting to apply critical updates. If your Plex Media Server is currently internet-facing, it is imperative to verify its version and security status immediately. Taking action now can prevent your server from becoming another statistic in the Shadowserver Foundation’s tally of compromised machines, protecting your resources, privacy, and digital security.