Plex Media Server, CVE-2026-96652: on CISA's exploited list

The bottom line

Anyone running Plex Media Server older than 1.43.3.10861 should update by 3 November 2026, and today if it faces the internet. Check the version in Settings → General first. If you run no Plex server, you can stop reading.

Free analysis report · 9 pagesPlex Media Server, CVE-2026-96652: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker with no account can make the Plex server send a request to any address they choose. The record says any X-Plex-Token value is accepted, and the attacker puts a full web address in the 'protocol' parameter of the '/player/timeline' endpoint.

Why it matters

The record says this flaw lets an attacker make the server send requests for them. The vendor's forum post of 19 October 2026 says it was chained with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to run code as the Plex process. It also says compromised servers ran cryptocurrency miners and proxy software. Our reading is that the 4.3 score in the CISA advisory file understates it: this is one link in an attack chain. Treat the four flaws as one problem.

What the vendor's advisory says

We read three pages on forums.plex.tv and raw.githubusercontent.com. In short:

• The vendor's post says Plex Media Server 1.43.3.10861 and later are not affected by the four chained flaws.
• It also lists CVE-2026-96654 (internal agent functions over the loopback interface), CVE-2026-96655 (disclosure of the admin token) and CVE-2026-96656 (arbitrary file write to the Codecs directory).
• The vendor says a public proof of concept was released on 16 October, followed by widespread attacks on internet-facing servers that were not updated.
• The vendor says that if your server is older than 1.43.3.10861 and reachable from the internet, you should assume it may be compromised.
• If you find signs of compromise, the vendor says to rebuild from a clean installation, sign out of all devices and change your Plex password.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It only scores 4.3, so it can wait." The vendor says it is part of a chain that gives remote code execution, and that it is being actively exploited.
• "It needs a token, so the attacker needs an account." The record says any X-Plex-Token value works. The vendor calls the flaw unauthenticated.
• "Updating cleans up a server that was already hit." The vendor says a compromised server should be rebuilt from a clean installation, not reuse the old data directory.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the versions you run

• List every Plex Media Server, including those on a NAS, in Docker or on a spare PC.
• Open Plex Web, go to Settings → General and read the version shown. The vendor says to look there.

dpkg -s plexmediaserver | grep Version
docker ps --format '{{.Names}} {{.Image}}' | grep -i plex

Step 2: Reduce exposure until it is patched

• If you cannot update today, take the server off the internet, for example by removing the router port forward. The vendor's warning concerns internet-facing servers.

ss -tlnp | grep 32400

Step 3: Update to the fixed version

• Move to 1.43.3.10861 or newer. The vendor says update instructions for each platform are in its original post.
• Check Settings → General again afterwards.

Step 4: Check for signs of compromise

• Look for processes started by Plex that you do not recognise, and for unfamiliar .so or .dll files in the Codecs folder.
• If you find any, follow the vendor's advice: rebuild clean, empty Codecs, check Preferences.xml, sign out all devices and change the password.

ps aux | grep -i plex

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello. CISA lists CVE-2026-96652 in Plex Media Server as exploited, with a deadline of 3 November 2026. Please tell us whether we run Plex Media Server anywhere, and on which machines. For each one, we need the version and whether it can be reached from the internet. The vendor says versions before 1.43.3.10861 are affected and 1.43.3.10861 or later is not. Please update any older server and check it for signs of compromise, as the vendor describes. Please confirm in writing the version now running on each server and that the fix is in place, by 3 November 2026. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Processes started by Plex Media Server that you do not recognise, such as myawesomeproxy, mylovelyminer or x12345.
• Unfamiliar .so or .dll files in the Plex Codecs folder, or transcoder options in Preferences.xml that you did not set.
• Outbound connections to proxystream.st, or sustained high CPU use while nothing is playing.

The weakness behind it

The record classes this as CWE-918 (Server-Side Request Forgery).

• CWE-918: Server-Side Request Forgery →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

The CVE record, published by Cisa-cg on 23 September 2026:

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Versions of Plex Media Server the record lists as affected:

• all versions before 1.43.3.10861

It lists these as unaffected:

• 1.43.3.10861

The affected ranges end before 1.43.3.10861. Those are the first versions the record does not list as affected; confirm them in the vendor's advisory.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• The sources do not say how many servers were compromised or who is behind the attacks.
• The vendor's list of signs is examples (process names, a domain, Codecs files), not a complete list. A clean check does not prove a server is clean.
• The sources do not say what the Plex service account could reach on your network. That depends on your setup.
• The vendor's earlier release note warns that some app stores, such as QNAP, may be slow to offer an update. The sources do not say when each platform gets 1.43.3.10861.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.