Plex Media Server: four exploited CVEs in the CISA KEV catalog

On 20 October 2026 CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The catalog lists vulnerabilities for which the agency has evidence of active exploitation.

The four CVEs were published on 23 September 2026. The NVD entries, updated on 20 October, point to the same sources: the Plex release notes, a CISA CSAF advisory (va-26-266-01) and the technical analysis published under the name Plex2Shell.

The four vulnerabilities

According to the NVD descriptions:

• CVE-2026-96656 (CWE-73, external control of file name or path): an admin user can write arbitrary files that may be executed on load. The TranscoderH264Options preference is appended verbatim to x264’s option string on every transcode; at startup, all .so files are run without signature, execute bit or symbol checks. CVSS 4.0 8.6 (high), CVSS 3.1 7.2, with high privileges required (PR:H) and high impact on confidentiality, integrity and availability.
• CVE-2026-96655 (CWE-918, server-side request forgery): an authenticated user can make the server request arbitrary internal or external addresses via the /video/:/transcode/universal path parameter. CVSS 4.0 5.3, CVSS 3.1 4.3.
• CVE-2026-96654 (CWE-84, improper neutralization of encoded URI schemes in a web page): URL values included in searchOne are not correctly neutralized, allowing an attacker to call other plugins’ functions with their own parameters. CVSS 4.0 6.9, CVSS 3.1 6.5. It is the only one of the four with a vector requiring no privileges (PR:N) and no user interaction.
• CVE-2026-96652 (CWE-918, server-side request forgery): SSRF via /player/timeline. Using any X-Plex-Token value, an attacker can include a full URL in the protocol parameter and force the Plex server to send a POST request to a destination of their choice. CVSS 4.0 5.3, CVSS 3.1 4.3.

Taken one by one, three of the four are rated medium. The entries do not describe how the flaws are combined in attacks: for that they refer to the Plex2Shell analysis. CISA added them to the catalog on the same day, and all of them are fixed by the same update.

Relevant MITRE ATT&CK techniques (our mapping): T1190 Exploit Public-Facing Application and T1129 Shared Modules, for the loading of .so libraries.

Affected versions: an inconsistency to be aware of

The NVD descriptions list Plex Media Server versions before 1.43.3.10861 as vulnerable. The CPE configuration of the same entries, however, reads < 1.43.0.10861. The two do not match: to be safe, treat every version before 1.43.3.10861 as vulnerable and check the Plex release notes linked from the entries.

What CISA asks

The KEV entries ask to:

• apply mitigations per vendor instructions, following CISA’s BOD 26-04 directive on prioritizing security updates based on risk and its “Forensics Triage Requirements”;
• for cloud services, follow the same directive or discontinue use of the product if mitigations are unavailable;
• assess the internet exposure of every asset.

For US federal agencies there are two deadlines: 23 October 2026 for CVE-2026-96656 and CVE-2026-96654, and 3 November 2026 for the two SSRFs, CVE-2026-96655 and CVE-2026-96652. Under known use in ransomware campaigns, the entries say “Unknown”. KEV does not name victims, actors or indicators of compromise.

Impact for European and Italian companies

Plex Media Server was built for home use, but it can also be found in companies, on a server, a NAS or a virtual machine, often installed outside IT processes and therefore missing from inventories. According to CISA the vulnerabilities are exploited: an unpatched instance reachable from the internet should be considered at real risk. As described, the two SSRFs allow requests to internal or external addresses to be launched from the Plex server.

CISA’s deadlines do not apply to European companies, but they show the priority the agency gives to these vulnerabilities. For entities in scope of NIS2, handling exploited vulnerabilities is part of the required security measures, and a compromised server on the corporate network is an incident to assess for notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Take inventory: look for Plex Media Server instances on servers, NAS devices and virtual machines, including those installed without going through IT.
2. Update to 1.43.3.10861 or later, starting with internet-facing instances.
3. If you cannot update right away, take the instance off the internet; CISA also contemplates discontinuing use of the product if mitigations are unavailable.
4. Review administrators: CVE-2026-96656 requires an admin account, so check who holds these privileges on the server.
5. Perform forensic triage, as CISA asks, starting from the elements in the NVD descriptions:
   • the value of the TranscoderH264Options preference, looking for unexpected options;
   • new or unknown .so files among those loaded by the Plex server;
   • requests to /player/timeline with a full URL in the protocol parameter, requests to /video/:/transcode/universal with addresses in the path, and unusual URL values in searchOne;
   • outbound POST requests from the Plex server to unrecognized destinations.
6. If you find traces: isolate the machine, reinstall it from a trusted source, change credentials and tokens stored on the host, and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet and which products with known vulnerabilities are recognized on them: it helps you find out whether a Plex server is reachable from outside. ARX Watch finds devices on the network that have no probe, such as NAS devices. On computers and servers running the ARXDOME agent, ARX Sentry collects the inventory of software, processes and ports and checks file integrity in the chosen folders, while ARX Shield lists open vulnerabilities, highlighting those already exploited, and lets you isolate a suspicious machine from the network.

Last updated: 20 October 2026