Plex Media Server in CISA KEV: Four Chainable CVEs, From Forged Request to Code Execution

On October 20, 2026, CISA added four Plex Media Server CVEs to its KEV catalog in one go. NVD published all four on September 23, 2026. On their own, none is critical: the highest sits at 7.2 in CVSS 3.1. But CISA explicitly describes them as chainable with one another, and it's the chain that's being exploited.

Plex tends to be filed under home entertainment. Yet it runs on NAS boxes, internet-facing home servers and plenty of small offices. A compromised Plex server is a foothold on whatever network hosts it.

The Four Vulnerabilities

All scores come from the CNA that published the CVEs, not from an NVD analysis; all four records have NVD status Modified. CVSS 3.1 vectors:

• CVE-2026-96656: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• CVE-2026-96654: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• CVE-2026-96652 and CVE-2026-96655: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What Each Link Does

CVE-2026-96652: SSRF on /player/timeline. According to NVD, an attacker presenting any X-Plex-Token value can put a full URL in the protocol parameter and force the Plex server to POST to a destination of their choosing. The server becomes a relay into the internal network.

CVE-2026-96655: SSRF in transcoding. An authenticated user can make the server request arbitrary internal or external addresses through the path parameter of /video/:/transcode/universal.

CVE-2026-96654: searchOne. Plex doesn't properly neutralize URL values included in searchOne, which lets an attacker call other plugins' functions with parameters of their own. It's the only one of the four scored PR:N: no privileges required.

CVE-2026-96656: from a setting to running code. This is the final link, and the most serious. NVD spells out two behaviors:

1. the TranscoderH264Options preference is appended verbatim to x264's option string on every transcode;
2. at startup, every .so file is loaded with no signature, execute-bit or symbol checks.

So an administrator can write an arbitrary file, and that file may run the next time it's loaded. The 7.2 score reflects PR:H: admin rights are needed.

How the chain fits together

Neither NVD nor CISA publishes the exact attack sequence. What follows is an inference from the descriptions: the two SSRFs and the plugin call are ways to reach functions or endpoints that shouldn't be reachable, up to acting with administrator rights; CVE-2026-96656 then turns those rights into code execution on the host. NVD's references point to a public technical write-up of the chain ("plex2shell") and to a blog post reporting exploitation in the wild.

The KEV entry lists any link to ransomware campaigns as unknown.

Affected Versions

All four NVD descriptions say: Plex Media Server before 1.43.3.10861.

⚠️ Watch out for an inconsistency in the data: NVD's CPE configuration sets the excluded upper bound at 1.43.0.10861, while the description says 1.43.3.10861. The Plex advisory cited by CISA is titled "Important security update for Plex Media Server v1.43.2 and earlier". Go with the safer bound: anything older than 1.43.3.10861 needs updating, and confirm the version to install on the Plex forum (linked from the KEV entry).

These numbers are bounds, not necessarily the latest release: install the newest version available for your platform.

Checking the installed version: in the web app under Settings → General, or through the local API:

curl -s http://127.0.0.1:32400/identity

Detection

• The TranscoderH264Options preference: it should be empty or match what you set. Any unexpected option is suspicious.
• Recent .so files in Plex's directories that you didn't install (compare their timestamps with your last update).
• Outbound requests from the Plex server to internal addresses (RFC1918, 169.254.169.254) or unusual destinations: that's what the SSRFs look like.
• Hits on /player/timeline with a protocol parameter holding a full URL, and on /video/:/transcode/universal with odd paths, in the server's or a reverse proxy's logs.
• New accounts or shares added without your involvement.

Mitigation

1. Update Plex Media Server to at least 1.43.3.10861. There are two CISA deadlines: October 23 for CVE-2026-96654 and CVE-2026-96656, November 3 for the two SSRFs.
2. Don't expose port 32400 directly to the internet unless you need to; use Plex's relay or a VPN instead.
3. Filter the Plex server's egress: it has no business reaching your management network or a cloud metadata service.
4. If the server was exposed before updating: the update doesn't remove a .so file already planted. Inspect the files, clear TranscoderH264Options, change the Plex account password and revoke authorized devices.

The KEV entry also points to the forensic triage requirements of BOD 26-04: for an exposed server, inspection is part of remediation.

Why "Side" Software Needs Continuous Monitoring Too

Plex shows up in almost no corporate inventory, and that's exactly the problem: four MEDIUM and HIGH CVEs go unnoticed for a month, then CISA gives three days. Software missing from the inventory never triggers an alert.

With cveo.tech, declare every piece of software running across your estate, including the non-business ones, and get an alert as soon as a CVE affecting them enters the CISA KEV catalog.