{"metadata": {"vulnerability": "CVE-2026-96655", "count": 25, "kinds": {"milestone": 4, "sighting": 5, "kev": 5, "other": 11}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96655", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-14T18:23:48.400Z", "date_only": false, "value": "2026-09-14T18:23:48.400949Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96655", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-09-14T18:23:48.400Z", "date_only": false, "value": "2026-09-14T18:23:48.400949Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96655", "record": "FKIE_CVE-2026-96655", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T14:42:25.245Z", "date_only": false, "value": "2026-09-23T14:42:25.245Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96655", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:06:53.133Z", "date_only": false, "value": "2026-09-23T16:06:53.133Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96655", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T16:06:53.133Z", "date_only": false, "value": "2026-09-23T16:06:53.133Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96655", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T16:34:51.715Z", "date_only": false, "value": "2026-09-23T16:34:51.715177Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96655", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-23T16:34:51.715Z", "date_only": false, "value": "2026-09-23T16:34:51.715177Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96655", "record": "FKIE_CVE-2026-96655", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-09-23T16:46:13.068Z", "date_only": false, "value": "2026-09-23T16:46:13.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96655", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-23T16:46:13.068Z", "date_only": false, "value": "2026-09-23T16:46:13.068Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96655", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9X88-W2P7-56VH", "record": "GHSA-9X88-W2P7-56VH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.677Z", "date_only": false, "value": "2026-09-23T17:17:23.677", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96655", "record": "FKIE_CVE-2026-96655", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9X88-W2P7-56VH", "record": "GHSA-9X88-W2P7-56VH", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9X88-W2P7-56VH", "record": "GHSA-9X88-W2P7-56VH", "field": "modified"}, {"timestamp": "2026-09-29T18:35:19.410Z", "date_only": false, "value": "2026-09-29T18:35:19.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96655", "record": "FKIE_CVE-2026-96655", "field": "lastModified"}, {"timestamp": "2026-10-18T23:02:48.841Z", "date_only": false, "value": "2026-10-18T23:02:48.841988Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96655", "field": "creation_timestamp", "uuid": "8a28dc80-0390-4c56-a30e-5bc8cf3ae354", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96655", "field": "timestamps.asserted_at", "uuid": "05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96655", "field": "evidence.0.details.added_date", "uuid": "05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96655", "field": "timestamps.first_seen_at", "uuid": "05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96655", "field": "status.status_updated_at", "uuid": "05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T13:25:26.346Z", "date_only": false, "value": "2026-10-19T13:25:26.346054Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96655", "field": "creation_timestamp", "uuid": "2ed6c397-3e2d-4e9e-904e-a2dd5e7a96f4", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.062Z", "date_only": false, "value": "2026-10-19T15:06:51.062358Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96655", "field": "creation_timestamp", "uuid": "495d977f-f3ca-4224-b6b2-039b84686143", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}, {"timestamp": "2026-10-20T03:38:06Z", "date_only": false, "value": "2026-10-20T03:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96655", "field": "creation_timestamp", "uuid": "46c12278-0b9a-47ca-8d3d-3ed96be59a20", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T12:00:01Z", "date_only": false, "value": "2026-10-20T12:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96655", "field": "timestamps.recorded_at", "uuid": "05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T12:00:57.028Z", "date_only": false, "value": "2026-10-20T12:00:57.028334Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f29eb5-b03d-4aa5-8234-a3e4f12f22db", "record": "CVE-2026-96655", "field": "creation_timestamp", "uuid": "9a10bae9-9307-4ca6-a0f9-0bc312b5285a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05f29eb5-b03d-4aa5-8234-a3e4f12f22db"}]}