CISA Gave One Plex Exploit Chain Two Different Federal Deadlines. Half of It Was Already Overdue.
If you run Plex Media Server and it is older than build 1.43.3.10861, update it today. That single build closes the entire Plex2Shell chain, and if your server was reachable from the internet before you patched, Plex's own guidance is to assume it may be compromised. Everything below is about how the chain got filed, not about whether you should patch. You should, now.
We covered the exploitation timing six days ago, when the proof-of-concept went public on October 16 and a honeypot caught it in use the following morning. This is a different finding, and we found it by reading CISA's catalog file rather than a summary of it.
What we found
On October 20, CISA added all four Plex2Shell flaws to the Known Exploited Vulnerabilities catalog. Same vendor, same product, same chain, same remediation, and identical required-action text on all four entries.
Then it gave them two different due dates.
CVE-2026-96654 and CVE-2026-96656 were due October 23 — three days. CVE-2026-96652 and CVE-2026-96655 are due November 3 — fourteen days. Today is October 26, so two of the four are already three days past their federal deadline while the other two still have a week to run.
The split does not follow the chain. It alternates down it.
The chain, and the clocks
The four flaws only matter together. Read in exploit order:
CVE-2026-96652 is the front door — an unauthenticated server-side request forgery where any X-Plex-Token value is accepted, and a full URL in the protocol parameter makes the server POST wherever the attacker says. Fourteen days.
CVE-2026-96654 turns that into reach, through encoded URI scheme handling that lets a caller invoke other plugins' functions with its own parameters. Three days.
CVE-2026-96655 escalates, a second SSRF through the transcode path parameter that requests arbitrary internal or external addresses. Fourteen days.
CVE-2026-96656 is the payload — external control of a file name or path, letting an admin-level caller write arbitrary files that execute on load. Three days.
Entry on the slow clock. Escalation on the slow clock. The two middle-and-end steps on the fast one. An attacker walks links one through four in order; the deadlines go slow, fast, slow, fast.
Why CISA did it, fairly
This is not a mistake, and it is worth saying so plainly before drawing any conclusion from it.
Every one of the four entries cites Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." The directive tells agencies to prioritize by risk, and CISA appears to have applied exactly that — scoring each CVE on its own severity and assigning the tier that score earns. The two that got three days are the plugin-function-call and the arbitrary-file-write. The two that got fourteen are the two SSRFs. On a per-CVE reading, that ordering is defensible.
Splitting a batch is also routine rather than exceptional. We measured it: across the whole catalog, 45 of 489 distinct catalog days carry more than one due date. The three-day-versus-fourteen-day pairing used here is the single most common split, 20 of those 45, and across all of them CISA draws on fourteen different combinations of deadline tiers. This is a standing practice, not a one-off slip.
So the policy worked as written. The question is what it was written against.
Why it mostly does not matter, and where it does
If you patch by product, none of this reaches you. One build fixes all four. A defender who updates Plex Media Server to 1.43.3.10861 is covered against the whole chain, and the two dates are a bookkeeping detail they will never see.
The split only bites someone who triages per CVE. That is not a strawman — it is how a lot of vulnerability management actually runs, because the catalog is a list of CVEs with per-CVE deadlines and tooling ingests it that way. Read like that, this entry says you have until November 3 to close the unauthenticated front door of a chain whose payload step was overdue on October 23. Nothing in the entries tells you the four are one thing. The chaining is mentioned in each description, and the deadline field disagrees with it.
That is the whole finding: a risk-ranking applied to individual CVEs produces a deadline ordering that does not describe the risk of the chain they belong to. Both halves of that sentence are true, which is why this is a seam rather than a scandal.
What we do not know
We cannot see CISA's scoring inputs, so "appears to have applied per-CVE severity" is inference from the pattern and the cited directive, not something we read in a decision record. We also do not know whether any agency actually triaged this chain per CVE and left the front door open — that would need telemetry we do not have.
And we have no first-party sighting here. We said so six days ago and it still holds: we run no Plex trap, our edge could not have seen this attack, and a check of the four attacker addresses against our edge blocks, canaries and origin honeypot back to May 1 returned nothing. The research credit for the chain belongs to zmain, and the first in-the-wild sighting to BoredHackerBlog. We are reading a public file carefully, which is a smaller thing than finding the bug, and we would rather say that than dress it up.
Call the whole thing 95% confident. Something in here will be slightly wrong, and the catalog may be re-dated after we publish.
What to do
Update Plex Media Server to 1.43.3.10861 or later. Stop forwarding port 32400 unless you genuinely need remote access. If the server was internet-facing on an older build, treat it as suspect rather than clean.
And if you run a vulnerability program off the KEV feed: group by product and fix, not by CVE. The catalog's deadlines are assigned per CVE because that is the unit the catalog is made of. Your patch is not.
Sources
- CISA Known Exploited Vulnerabilities catalog, known_exploited_vulnerabilities.json, retrieved and measured 2026-10-26 (1,756 entries)
- CISA Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk
- Plex Media Server release notes, build 1.43.3.10861
- Chain research: zmain. First in-the-wild sighting, indicators and packet captures: BoredHackerBlog.
- Our earlier coverage: "Plex2Shell Was Exploited Within a Day of the Exploit Going Public. The Patch Had Been Out for Six Weeks." (2026-10-20)
Her name was Renee Nicole Good.
His name was Alex Jeffery Pretti.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Get your free key → analytics.dugganusa.com/stix/register
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=cisa-gave-one-plex-exploit-chain-two-different-federal-deadlines-half-of-it-was-already-overdue