{"schema":"vulnpedia.research/1","cve":"CVE-2026-96652","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","origins":[{"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"source":"nvd","sourceId":"CVE-2026-96652","modified":"2026-10-21T13:09:44.770","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"}]},{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","tags":["release-notes","Release Notes"],"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","origins":[{"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","url":"https://forums.plex.tv/t/plex-media-server/30447/711"},{"source":"nvd","sourceId":"CVE-2026-96652","modified":"2026-10-21T13:09:44.770","url":"https://forums.plex.tv/t/plex-media-server/30447/711"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96652","tags":["vdb-entry","Third Party Advisory","VDB Entry"],"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","origins":[{"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96652"},{"source":"nvd","sourceId":"CVE-2026-96652","modified":"2026-10-21T13:09:44.770","url":"https://www.cve.org/CVERecord?id=CVE-2026-96652"}]},{"url":"https://zmain.info/blog/plex2shell","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","origins":[{"source":"mitre","sourceId":"cisa-cg","modified":"2026-09-23T16:06:15.517Z","url":"https://zmain.info/blog/plex2shell"},{"source":"nvd","sourceId":"CVE-2026-96652","modified":"2026-10-21T13:09:44.770","url":"https://zmain.info/blog/plex2shell"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-21T03:56:26.467Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-21T03:56:26.467Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652"},{"source":"nvd","sourceId":"CVE-2026-96652","modified":"2026-10-21T13:09:44.770","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652"}]},{"source":"euvd","sourceId":"EUVD-2026-85367","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85367","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-85367","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85367"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://vulncheck.com/xdb/a744d859fbf1","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"a744d859fbf1","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a744d859fbf1","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/a744d859fbf1"}]},{"url":"https://github.com/gmh5225/plex2shell","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"a744d859fbf1","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a744d859fbf1","modified":"2026-10-18T00:00:00Z","url":"https://github.com/gmh5225/plex2shell"}]},{"url":"https://vulncheck.com/xdb/564fa8759764","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"564fa8759764","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"564fa8759764","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/564fa8759764"}]},{"url":"https://github.com/code-zm/plex2shell","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"564fa8759764","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"564fa8759764","modified":"2026-10-18T00:00:00Z","url":"https://github.com/code-zm/plex2shell"}]},{"url":"https://vulncheck.com/xdb/e5488e213079","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"e5488e213079","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e5488e213079","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/e5488e213079"}]},{"url":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"e5488e213079","modified":"2026-10-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e5488e213079","modified":"2026-10-18T00:00:00Z","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/gmh5225/plex2shell","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656","modified":"2026-10-17T01:44:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/gmh5225/plex2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-17T01:44:36Z","url":"https://github.com/gmh5225/plex2shell"}],"tags":[]},{"url":"https://github.com/code-zm/plex2shell","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656","modified":"2026-10-25T18:04:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/code-zm/plex2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-25T18:04:24Z","url":"https://github.com/code-zm/plex2shell"}],"tags":[]},{"url":"https://github.com/ChrisLPJones/plex2shell-check","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild","modified":"2026-10-25T01:57:48Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/ChrisLPJones/plex2shell-check"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-25T01:57:48Z","url":"https://github.com/ChrisLPJones/plex2shell-check"}],"tags":[]},{"url":"https://github.com/w116tjb/plex2shell-windows-hunt","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script","modified":"2026-10-21T15:25:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/w116tjb/plex2shell-windows-hunt"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-21T15:25:50Z","url":"https://github.com/w116tjb/plex2shell-windows-hunt"}],"tags":[]},{"url":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)","modified":"2026-10-22T14:17:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-22T14:17:06Z","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652"}],"tags":[]},{"url":"https://github.com/TheGlitchFixer/plex2shell-check","source":"poc-in-github","sourceId":"CVE-2026-96652","description":"Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?","modified":"2026-10-24T03:15:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-96652","url":"https://github.com/TheGlitchFixer/plex2shell-check"},{"source":"poc-in-github","sourceId":"CVE-2026-96652","modified":"2026-10-24T03:15:12Z","url":"https://github.com/TheGlitchFixer/plex2shell-check"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"a744d859fbf1","url":"https://vulncheck.com/xdb/a744d859fbf1","cve":"CVE-2026-96652","dateAdded":"2026-10-17T01:44:36Z","modified":"2026-10-18T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/gmh5225/plex2shell","observations":[{"dateAdded":"2026-10-17T01:44:36Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"a744d859fbf1","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/a744d859fbf1"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"564fa8759764","url":"https://vulncheck.com/xdb/564fa8759764","cve":"CVE-2026-96652","dateAdded":"2026-10-19T16:03:40Z","modified":"2026-10-18T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/code-zm/plex2shell","observations":[{"dateAdded":"2026-10-19T16:03:40Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"564fa8759764","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/564fa8759764"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"e5488e213079","url":"https://vulncheck.com/xdb/e5488e213079","cve":"CVE-2026-96652","dateAdded":"2026-10-22T21:13:29Z","modified":"2026-10-18T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/basesixtythree/B63-POC-CVE-2026-96652","observations":[{"dateAdded":"2026-10-22T21:13:29Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"e5488e213079","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/xdb/e5488e213079"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-10-18T00:00:00Z","modified":"2026-10-18T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Plex","product":"Media Server","dueDate":"2026-11-03T00:00:00Z","cisaDateAdded":"2026-10-20T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","modified":"2026-10-18T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","catalog":"VulnCheck KEV","kind":"report","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","dateAdded":"2026-10-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-10-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-96652","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]}]}