Plex: four exploited flaws, and a server to update
CISA has added four Plex Media Server flaws to its catalog of exploited vulnerabilities. Check the server, not just the playback app. NVD has aligned its version boundaries at 1.43.3.10861.
Getting started
Generated image · SecuFocus
At a glance
Key points
Run a Plex server? CISA added four of its vulnerabilities to the Known Exploited Vulnerabilities catalog on October 20. Check the Plex Media Server version and apply the security update appropriate to your installation. Updating the TV’s playback app does not patch the server.
Four flaws with different prerequisites
CISA’s October 20 alert confirms evidence of active exploitation for CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. These are four flaws in one product, Plex Media Server, among the day’s six KEV additions.
Two flaws let an attacker make the server send requests to chosen destinations (SSRF). For CVE-2026-96652, the catalog describes using any X-Plex-Token value; CVE-2026-96655 requires an authenticated user. CVE-2026-96654 allows calls to other plugins’ functions with attacker-supplied parameters. CVE-2026-96656 lets an admin user write files that may execute when loaded. CISA says these flaws can be chained, so the prerequisites of an individual flaw do not describe the whole chain.
A scanner result is not enough
All four NVD records were revised on October 21. Their CPE field, used to identify affected software, now covers versions before 1.43.3.10861, matching their descriptions and the assigning organisation’s version data. The earlier CPE boundary of 1.43.0.10861 has been replaced. The conflict reported in our first version is no longer present in the records we consulted.
If you maintain Plex, check the installed version and the security update offered for your operating system or NAS package. The records now share 1.43.3.10861 as their reference point. An older scanner result may still use the replaced boundary and cannot establish that the server is patched. If someone else runs it, ask them to confirm the version and how they addressed these four CVEs.
Patch the server and consider what happened before
Before updating, keep a usable backup of the configuration your installation needs. Afterwards, check the server version and play a harmless file from a device you normally use. That functional check does not prove there was no intrusion.
The catalog lists October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for the two SSRF flaws. These deadlines belong to the US federal framework, not a legal requirement for home users. CISA also calls for forensic triage for CVE-2026-96656. If the server was exposed and you suspect an intrusion, have the available evidence examined: installing a patch does not establish what happened earlier.
This brief relies on CISA and NVD, not a reproduced attack. We did not use the linked Plex advisory directly because it is outside our authorised news-source list. KEV inclusion confirms known exploitation, not that every server has been compromised.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NVD: CVE-2026-96652, description and version boundaries ↗services.nvd.nist.gov ·
- NVD: CVE-2026-96654, description and version boundaries ↗services.nvd.nist.gov ·
- NVD: CVE-2026-96655, description and version boundaries ↗services.nvd.nist.gov ·
- NVD: CVE-2026-96656, description and version boundaries ↗services.nvd.nist.gov ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.