{"metadata": {"vulnerability": "CVE-2026-96654", "count": 37, "kinds": {"milestone": 4, "sighting": 9, "kev": 11, "other": 13}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-23T14:42:18.475Z", "date_only": false, "value": "2026-09-23T14:42:18.475Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:06:35.821Z", "date_only": false, "value": "2026-09-23T16:06:35.821Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.517Z", "date_only": false, "value": "2026-09-23T17:17:23.517", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "published"}, {"timestamp": "2026-10-18T23:02:48.864Z", "date_only": false, "value": "2026-10-18T23:02:48.864844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "312b45a4-3f00-4297-86dd-9a29037760a1", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-18T23:02:48.869Z", "date_only": false, "value": "2026-10-18T23:02:48.869546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "af972f61-9389-40e2-b3de-e78277ff7b5a", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.asserted_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96654", "field": "evidence.0.details.added_date", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.first_seen_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96654", "field": "status.status_updated_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T13:25:26.325Z", "date_only": false, "value": "2026-10-19T13:25:26.325129Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "7da4246f-878c-4bf2-ba42-3d5c92c1053f", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.046Z", "date_only": false, "value": "2026-10-19T15:06:51.046600Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "9217f30b-8912-4ab4-931c-afa9f31101c4", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.asserted_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "evidence.0.details.date_added", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.first_seen_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "status.status_updated_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-20T03:38:06Z", "date_only": false, "value": "2026-10-20T03:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "6c0d4767-53af-4c5a-b58b-a6df3a2170a4", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T08:38:06Z", "date_only": false, "value": "2026-10-20T08:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "0e2b4b93-efcb-4113-9e0a-06add9cc78bd", "content": "Rilevato lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 e CVE-2026-96656 - gi\u00e0 sanate dal vendor - relative a Plex Media Server. Si evidenzia che risulta disponibile in rete un Proof of Concept (PoC) per lo sfruttamento concatenato di tali vulnerabilit\u00e0.", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T12:00:01Z", "date_only": false, "value": "2026-10-20T12:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.recorded_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T12:00:57.559Z", "date_only": false, "value": "2026-10-20T12:00:57.559193Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19ca0962-cd78-443b-8989-362cacfa5362", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "59e4f54d-6719-4907-8718-5c02c5cb79e5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19ca0962-cd78-443b-8989-362cacfa5362"}, {"timestamp": "2026-10-20T12:30:39Z", "date_only": false, "value": "2026-10-20T12:30:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/44b72ac1-e095-4aee-ad97-df24053d6b2f", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "7eb702a1-59a0-4c4a-9ff7-7c6850356f57"}, {"timestamp": "2026-10-20T15:58:41.367Z", "date_only": false, "value": "2026-10-20T15:58:41.367540Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-10-20T15:58:41.367Z", "date_only": false, "value": "2026-10-20T15:58:41.367540Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T16:46:16.219Z", "date_only": false, "value": "2026-10-20T16:46:16.219Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T20:00:01Z", "date_only": false, "value": "2026-10-20T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.recorded_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T20:00:02.574Z", "date_only": false, "value": "2026-10-20T20:00:02.574192Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f78d056-e5e6-4768-b88c-16ee003828ba", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "367a88a5-d40f-4b88-b3f4-2bb1d748ab61", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f78d056-e5e6-4768-b88c-16ee003828ba"}, {"timestamp": "2026-10-20T21:30:35Z", "date_only": false, "value": "2026-10-20T21:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "modified"}, {"timestamp": "2026-10-21T03:56:25.683Z", "date_only": false, "value": "2026-10-21T03:56:25.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T03:56:25.683Z", "date_only": false, "value": "2026-10-21T03:56:25.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T13:09:37.607Z", "date_only": false, "value": "2026-10-21T13:09:37.607", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "lastModified"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "evidence.0.details.due_date", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}]}