Plex Media Server, CVE-2026-96654: on CISA's exploited list

The bottom line

If you run Plex Media Server older than 1.43.3.10861, update it now; CISA's date of 23 October 2026 has already passed. If it faces the internet, treat it as possibly compromised and check it. No Plex, nothing to do.

Free analysis report · 9 pagesPlex Media Server, CVE-2026-96654: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says the server does not neutralize URL values in 'searchOne', so an attacker can call other plugins' functions and supply their own parameters. The vendor says this was chained with three other flaws to run code on the server without a login.

Why it matters

Our reading is that this flaw is a stepping stone. The vendor's post describes it as access to internal agent functions over the loopback interface, which the other three flaws build on to run code. The record's score of 6.9 therefore understates the risk. The vendor says the four together are being widely exploited, with cryptocurrency miners and proxy software installed on victims' servers. An owner who sees a media server as harmless may leave it unpatched, yet it runs with whatever access its service account has.

What the vendor's advisory says

We read three pages on forums.plex.tv and raw.githubusercontent.com. In short:

• The vendor's post of 19 October 2026 lists four flaws fixed in 1.43.3: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
• The vendor says chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.
• The vendor says a public proof of concept was released on 16 October and that attacks against internet-facing, unpatched servers are widespread.
• The vendor says a server older than 1.43.3.10861 and reachable from the internet should be assumed possibly compromised.
• The vendor's workaround advice: turn off remote access under Settings → Remote Access if not needed, and avoid forwarding port 32400 directly.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• A 6.9 score means this can wait The vendor says this flaw is chained with three others and is being widely exploited. The score of one link does not describe the chain.
• Our server is only for media, so nothing of value is at risk The vendor says the service account's reach, such as mounted shares and stored credentials, should be treated as potentially exposed after a compromise.
• Updating removes anything an attacker already installed The vendor advises rebuilding from a clean installation if compromise cannot be ruled out. An update alone is not enough.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the versions you run

• Open Plex Web, go to Settings → General and read the version shown, as the vendor advises.
• Anything older than 1.43.3.10861 is affected. Check every host, VM and container that runs Plex.

dpkg -l plexmediaserver
rpm -q plexmediaserver
docker ps --format '{{.Names}} {{.Image}}'

Step 2: Reduce exposure

• If you do not need remote access, turn it off under Settings → Remote Access.
• Avoid forwarding port 32400 directly unless you need it.

Step 3: Update to a fixed version

• Move to 1.43.3.10861 or newer, using the vendor's update instructions for your platform.
• Read the version again afterwards to confirm it.

Step 4: Check for signs of compromise

• Look for the signs in the next section. If you find any, or cannot rule it out, rebuild from a clean installation rather than reusing the old data directory.
• Sign out of all devices, change the Plex password and treat anything the service account could reach as exposed.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we have seen that Plex Media Server CVE-2026-96654 is being exploited and CISA's date of 23 October 2026 has passed. Please find out whether we run Plex Media Server anywhere, and on which hosts. Please tell us the version on each. The vendor says 1.43.3.10861 or later is not affected. If any host is older, please update it, turn off remote access if it is not needed, and check for signs of compromise. Please confirm in writing, by the end of this week, the version on each host and that the fix is in place.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Processes started by Plex Media Server that you do not recognise, or sustained high CPU use while nothing is playing.
• Unfamiliar .so or .dll files in the Plex Codecs folder, or transcoder options in Preferences.xml that you did not set.
• Outbound connections from the server that you cannot explain, which the vendor links to proxy software.

The weakness behind it

The record classes this as CWE-84 (Improper Neutralization of Encoded URI Schemes in a Web Page).

The sources, in their words

CISA's catalogue entry:

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

The CVE record, published by Cisa-cg on 23 September 2026:

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Versions of Plex Media Server the record lists as affected:

• all versions before 1.43.3.10861

It lists these as unaffected:

• 1.43.3.10861

The affected ranges end before 1.43.3.10861. Those are the first versions the record does not list as affected; confirm them in the vendor's advisory.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• The sources do not say whether CVE-2026-96654 can be exploited on its own, without the other three flaws.
• The sources do not say whether servers reachable only from an internal network have been attacked.
• The vendor's post and the CSAF record describe CVE-2026-96655 differently (admin token disclosure versus a server-side request flaw).
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.