Plex Media Server CVE-2026-96656 Chain: Patch and Hunt

Plex Media Server builds older than 1.43.3.10861 contain four vulnerabilities that the US Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026. Plex says that, chained together, they let an unauthenticated remote attacker run code on the server, and that exploitation is now wide. The fix has been available since September. If you run Plex anywhere, at home, in a lab or on a company network, update it, then check whether it was compromised before you updated.

Scope. We read the four CVE records in the CVE List, CISA’s machine-readable advisory VA-26-266-01, the KEV catalog (version 2026.10.21) and Plex’s security thread on its forums, including the October 19, 2026 update, on October 22, 2026. We did not test the vulnerabilities or the proof of concept. For how KEV deadlines work, see our explainer on BOD 26-04.

What is affected and what fixes it

Every one of the four CVE records lists Plex Media Server before 1.43.3.10861 as affected and 1.43.3.10861 as unaffected. CISA, acting as the CVE Numbering Authority, published the records and the advisory on September 23, 2026.

The individual scores look moderate. That is the trap: each score rates one flaw on its own, while the risk comes from the chain. Plex’s update says that chained, the four “allow an unauthenticated remote attacker” to execute code as the server process. Plex has not published the chain step by step, and we have not reproduced it. Our reading of the CVE descriptions is that the request-forgery and injection flaws provide the access that the file-write flaw, which on its own needs admin rights, requires. Treat that as interpretation, not a confirmed sequence.

The same advisory lists a fifth flaw, CVE-2026-96651, a path traversal in /system/agents/media/get that can read files including the PlexOnlineToken, which the advisory says “grants control of the Plex account and server”. It is not in KEV, and CISA’s enrichment dated September 23 records no exploitation. The same build fixes it.

What changed: from routine update to active exploitation

KEV details

Each KEV entry says the flaw can be chained with the other three. The deadlines bind US federal civilian agencies under BOD 26-04; for everyone else they are a signal of urgency. CISA’s catalog does not explain why two flaws got three days and two got fourteen.

What to do now

1. Update and confirm the build number

Update Plex Media Server to 1.43.3.10861 or later, then confirm the version under Settings → General in Plex Web, as Plex’s notice describes. “1.43.3” alone is not enough to be sure: Plex’s later update gives the full build number as the threshold. Plex also tells desktop users to update Plex Desktop.

2. Decide whether the server was exposed

Plex’s guidance is that a server running an older build that was reachable from the internet “may be compromised”. Exposure usually came from Plex’s Remote Access feature or a port forward. Plex specifically advises against forwarding port 32400 directly and suggests turning remote access off if you don’t need it.

3. Look for the signs Plex lists

Plex’s October 19 update names these indicators:

• Processes you don’t recognize running as the Plex user.
• Unfamiliar .so (Linux) or .dll (Windows) files in the Plex Codecs folder.
• Outbound connections to proxystream.st.
• High CPU use while nothing is playing.
• Transcoder options you did not set in Preferences.xml, which ties directly to CVE-2026-96656’s TranscoderH264Options behavior.

The location of the Codecs folder and Preferences.xml depends on your operating system and install method; Plex’s support documentation lists them. A clean result is not proof of a clean server: these are the indicators Plex has published so far, and an attacker can remove files.

4. If you find something, or can’t rule it out

Plex’s update recommends rebuilding from a clean installation, clearing the Codecs folder and reviewing Preferences.xml. It also says to sign out of all devices and change the Plex account password, and to treat any network shares or credentials the Plex service account could reach as potentially exposed. Because CVE-2026-96651 can expose the server token, signing out all devices after updating is sensible even without other signs; Plex’s notice does not explicitly address token rotation.

For companies

If Plex appears in an asset inventory or scanner export, check for it on employee-run lab machines and NAS devices too. Media servers often run under accounts with broad read access to shared storage, which is what turns a hobby service into a foothold. Our guide to matching the KEV feed against a scanner export shows how to flag entries like these automatically. If you are new to SSRF, our SSRF explainer covers why “make the server send a request” is so often the first link in a chain.

Limits of this article

We did not run the proof of concept or confirm the chain’s steps. Plex’s statements about exploitation, the proof-of-concept date and the indicators come from its forum post and are not independently verified. We did not read the researcher’s write-up referenced in the CVE records. KEV entries and Plex’s guidance may change; check the sources below for updates.

Sources and verification

Checked on October 22, 2026.

Vulnerability ManagementIncident ResponseKev