Key points
- CISA added four CVEs to the Known Exploited Vulnerabilities catalog on 20 October 2026.
- Affected products are Plex Media Server versions prior to 1.43.3.10861.
- The flaws allow arbitrary file writes and server-side request forgery attacks.
The US Cybersecurity and Infrastructure Security Agency added four flaws in Plex Media Server to its Known Exploited Vulnerabilities catalog on 20 October 2026. The entries cover versions before 1.43.3.10861 and include a high-severity file-write issue alongside three medium-severity defects.
What happened
CISA listed CVE-2026-96656, CVE-2026-96655, CVE-2026-96654 and CVE-2026-96652 in the federal catalog on 20 October 2026. The National Vulnerability Database records these flaws as affecting Plex Media Server builds older than 1.43.3.10861. CVE-2026-96656 carries a CVSS score of 8.6, classified as high severity by the NVD.
The high-severity flaw allows an administrator to write arbitrary files that may execute on load. The NVD notes that the TranscoderH264Options preference is appended verbatim to the x264 option string during transcoding. At startup, shared object files are executed without signature or symbol checks.
CVE-2026-96655 and CVE-2026-96652 are both rated medium with a CVSS of 5.3. These server-side request forgery vulnerabilities let authenticated users or holders of any X-Plex-Token force the server to make requests to arbitrary addresses.
CVE-2026-96654 is rated medium with a CVSS of 6.9. This improper neutralisation flaw allows attackers to call other plugins' functions by supplying their own parameters via URL values. CISA states that these vulnerabilities can be chained together.
Why it matters
Organisations using Plex Media Server before version 1.43.3.10861 must address these issues to meet federal compliance requirements. CISA set a due date of 23 October 2026 for CVE-2026-96656 and CVE-2026-96654. The deadline for CVE-2026-96655 and CVE-2026-96652 is 3 November 2026.
The ability to write arbitrary files and execute them on load poses a risk to system integrity. Chaining these flaws could allow attackers to combine the effects of multiple vulnerabilities. Federal agencies must apply mitigations in accordance with vendor instructions and BOD 26-04 guidance.
What happens next
- Verify that all Plex Media Server instances are running version 1.43.3.10861 or later.
- Review CISA’s Business Directive 26-04 for prioritisation and compliance requirements.
- Assess internet exposure of affected assets to determine remediation urgency.
- Discontinue use of the product if no mitigations are available for legacy systems.
Patch priority
Teams usually prioritise systems exposed to the internet or untrusted networks first. Check whether critical assets run vulnerable versions before rolling out updates. Test patches in a staging environment to ensure stability and compatibility with existing workflows. Back up configurations and data prior to applying changes to allow for rollback if issues arise. Monitor logs for unusual activity during the transition period to detect any exploitation attempts.
What to do and how to stay safe
- Audit all servers to identify instances of Plex Media Server older than version 1.43.3.10861.
- Restrict network access to Plex services to minimise exposure to untrusted users.
- Review authentication tokens and access controls to limit potential abuse of SSRF flaws.
- Prepare to apply updates once the vendor provides a confirmed fix for these vulnerabilities.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Plex Media Server versions are affected by these CVEs?
Versions before 1.43.3.10861 are affected by CVE-2026-96656, CVE-2026-96655, CVE-2026-96654 and CVE-2026-96652.
