Skip to content
brandefense.io
Request A Demo
Trending Vulnerabilities

Why it is trending

CVE-2026-96652

Plex Media Server SSRF

Known-bad
  • CVSS 5.3
  • CIRCL KEV
  • CISA KEV
  • CISA SSVC: active
  • ENISA KEV
  • VulnCheck KEV
  • Public PoC
Buzz
25discussion, 0-100
Danger
72exploitability, 0-100
Mentions
8since 17 Oct 2026
EPSS
0.5%exploit probability
Mentions Per Day · UTCpeak 3
29 days agoToday
Where The Talk Is · by platform8 total
  • GitHub5 mentions · 5 voices · 5 PoC
  • X1 mentions · 0 voices
  • Reddit1 mentions · 1 voices
  • Dark web1 mentions · count only

    Out of 8 mentions in total. We show how many, never what was said or where.

Newest Public Posts · plain text, newest first

X

  • 🚨 CISA has ordered federal civilian agencies to immediately patch a devastating 4-vulnerability exploit chain in Plex Media Server dubbed "Plex2Shell" (CVE-2026-96652 et al.). Disclosed by researcher Zach Main, unauthenticated attackers on the internet can achieve full remote code execution on any…

    @_pksharma2 h agolikes 0views 26replies 0Open

GitHub

  • GitHub cross-source: basesixtythree/B63-POC-CVE-2026-96652: PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)

    basesixtythree/B63-POC-CVE-2026-9665233 h agostars 0PoCOpen

  • GitHub cross-source: w116tjb/plex2shell-windows-hunt: Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script

    w116tjb/plex2shell-windows-hunt2 d agostars 0PoCOpen

  • GitHub cross-source: ChrisLPJones/plex2shell-check: Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild

    ChrisLPJones/plex2shell-check4 d agostars 0PoCOpen

  • GitHub cross-source: code-zm/plex2shell: CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

    code-zm/plex2shell6 d agostars 97PoCOpen

  • GitHub cross-source: gmh5225/plex2shell: CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

    gmh5225/plex2shell7 d agostars 0PoCOpen

Reddit

  • Patch or Pass #1: Plex Media Server exploit chain now in CISA KEV, PAN-OS GlobalProtect (CVE-2026-0257) used by Qilin and Inc ransomware, plus 2 EOL boxes with no patch — This week's actively exploited flaws, sorted by urgency: - **Plex Media Server CVE-2026-96652/96654/96655/96656** (added to CISA…

    r/blueteamsec28 h agoOpen
Public PoC Repositories · third-party code5 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe