CVE-2026-96656 and 3 related: Plex Media Server Multiple Critical Flaws Enable Remote Exploitation and Arbitrary Code Execution
Plex Media Server before version 1.43.3.10861 contains four actively exploited vulnerabilities including arbitrary file execution, SSRF, URL manipulation, and plugin parameter injection. Together these flaws allow remote attackers to compromise the server and internal networks.
Four separate but related vulnerabilities in Plex Media Server allow an attacker to execute code, manipulate the server into accessing internal resources, bypass URL restrictions, and inject malicious parameters. These flaws span unauthenticated access (CVSS 6.5), authenticated low-privilege access (CVSS 4.3, 4.3), and admin-level exploitation (CVSS 7.2). All are actively exploited.
| CVEs | CVE-2026-96656 (CVSS 7.2), CVE-2026-96654 (CVSS 6.5), CVE-2026-96655 (CVSS 4.3), CVE-2026-96652 (CVSS 4.3) |
|---|---|
| Severity | High (highest CVSS 7.2) |
| Actively exploited | Yes (CVE-2026-96656, CVE-2026-96654, CVE-2026-96655, CVE-2026-96652), listed in CISA's Known Exploited Vulnerabilities catalog on 20 Oct 2026 |
| CISA remediation deadline | 23 Oct 2026 |
| Weakness | CWE-73, CWE-84, CWE-918 (server-side request forgery (SSRF)) |
| Attack vector | Network |
| Privileges required | High |
| User interaction | None |
| Published | 23 Sept 2026 |
How the attack works
The vulnerabilities work in combination: an unauthenticated attacker can manipulate URL schemes via the 'searchOne' parameter to call plugin functions and inject parameters (CVE-2026-96654); authenticated users can force the server to connect to arbitrary internal or external addresses via the transcode path (CVE-2026-96655, CVE-2026-96652); and an admin user can inject x264 options that load and execute arbitrary .so files without signature or permission checks (CVE-2026-96656). Attackers can chain these to achieve remote code execution.
Who is affected
All Plex Media Server installations running versions before 1.43.3.10861 are affected, regardless of deployment model (self-hosted, cloud, or managed).
Affected products listed:
- Plex Media Server (before 1.43.3.10861)
How to check if you're exposed
- Query all Plex Media Server instances for version number (check Settings > About in UI or via API endpoint /identity)
- Verify if any version is below 1.43.3.10861
- Review Plex Media Server logs for suspicious transcode requests, unusual plugin calls, or file write operations in plugin directories
- Monitor network traffic from Plex server for unexpected outbound connections or SSRF-like internal requests
How to fix it
- Update Plex Media Server to version 1.43.3.10861 or later from the official Plex website or package manager
- For cloud-hosted Plex services, verify your provider has deployed the patch and audit their BOD 26-04 compliance
- Restart the Plex server after patching to ensure all code changes take effect
If you can't patch yet
- Restrict network access to the Plex Media Server to trusted internal networks only; do not expose it directly to the internet until patched
- Limit admin account usage and monitor admin activity logs for suspicious configuration changes or file operations
- Disable or remove untrusted plugins and restrict plugin parameter input
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.