Plex confirms four Media Server flaws are being actively exploited
CISA added CVE-2026-96652, -96654, -96655 and -96656 to its KEV list on 20 October. Plex says chained together they allow remote code execution on servers older than 1.43.3.10861.
Plex said on 19 October 2026 (UTC) that four vulnerabilities fixed in Plex Media Server 1.43.3 are being actively and widely exploited. CISA added all four to its Known Exploited Vulnerabilities (KEV) catalog on 20 October 2026.
What Plex says
The CVEs are CVE-2026-96652 (unauthenticated server-side request forgery in the player timeline endpoint), CVE-2026-96654 (access to internal agent functions over the loopback interface), CVE-2026-96655 (disclosure of the server owner's admin token) and CVE-2026-96656 (arbitrary file write to the Codecs directory through transcoder preferences). Plex says chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.
Plex says a public proof of concept was released on 16 October and it has seen widespread attacks on internet-facing servers that were not updated. It reports compromised servers being used to run cryptocurrency miners and proxy software. Plex Media Server 1.43.3.10861 and later are not affected.
Plex's guidance
Plex says to update to 1.43.3.10861 or newer and to assume an internet-reachable older server may be compromised. It lists signs to check, including unfamiliar processes started by Plex, unfamiliar .so or .dll files in the Codecs folder, outbound connections to proxystream.st and sustained high CPU use while nothing is playing. If remote access isn't needed, Plex says to turn it off.
CISA
CISA lists the four CVEs as known exploited and, in its entries, says they can be chained. Its due dates for federal agencies are 23 October for CVE-2026-96654 and CVE-2026-96656 and 3 November for CVE-2026-96652 and CVE-2026-96655.