Plex2Shell, Plex Media Server four-CVE chain (CVE-2026-96652 / -96654 / -96655 / -96656)

EPSS

0.018
some chance of attack soon

VEDAS

0.967
strong exploit evidence

On CISA KEV

Yes, since 2026-10-20

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

EPSS

0.019
some chance of attack soon

VEDAS

0.516
some exploit evidence

On CISA KEV

Yes, since 2026-10-20

Detection rule

None yet

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

EPSS

0.016
some chance of attack soon

VEDAS

0.986
strong exploit evidence

On CISA KEV

Yes, since 2026-10-20

Detection rule

Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

EPSS

0.018
some chance of attack soon

VEDAS

0.985
strong exploit evidence

On CISA KEV

Yes, since 2026-10-20

Detection rule

Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.