Say your office has a NAS for shared files. One day someone in IT installs Plex Media Server on it so training videos and product clips can play on the meeting room TV, and turns on remote access so it works from outside the office too. The program never makes it onto the company software list, and nobody owns its updates.
If that program is compromised, the attacker gets whatever the Plex service account can reach, which often includes the work folders on the same NAS. This is happening right now.
What happened
On 20 October 2026 CISA, the US cybersecurity agency, added six entries to its Known Exploited Vulnerabilities (KEV) catalog. Four of them are in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
According to NVD, all four affect Plex Media Server before 1.43.3.10861. Each does something different:
- Two are server-side request forgery (SSRF) flaws that make the Plex server send requests to a destination the attacker picks.
- One lets an attacker call another plugin's functions with parameters of their choosing.
- One lets an admin user write files that the server runs at startup. Its CVSS 3.1 score is 7.2.
Taken one by one, most of these scores look moderate. Censys, a company that scans internet-facing hosts, explains that chained together, in what the researcher named Plex2Shell, they let an attacker run code on the host with the privileges of the account running Plex.
The timeline, as reported by Censys:
- 4 August 2026: Plex releases 1.43.3.10861, which fixes the whole chain.
- 1 September 2026: Plex publishes a security notice.
- 16 October 2026: a researcher publishes the write-up and exploit code.
- 17 October 2026: a honeypot operator sees exploitation in the wild, one day after publication.
- 19 October 2026: Plex reports active, widespread exploitation. Compromised servers were used for crypto miners and proxy software.
- 20 October 2026: CISA adds all four to KEV.
In the KEV catalog, CISA gives US federal agencies until 23 October to fix CVE-2026-96654 and CVE-2026-96656, and until 3 November 2026 for the other two.
The number worth sharing: the patch existed, the servers did not move
Censys counts about 324,000 hosts running Plex Media Server, and about 30% still run a vulnerable build. The figure worth repeating to your team: in the first three days after the exploit was published and attacks were reported, fewer than 2% of the still-vulnerable hosts upgraded.
Censys also summarises Plex's guidance. Windows and macOS installs update themselves if that option is on. Linux, NAS and Docker installs need a manual update, which is exactly where many companies forget.
More important than the numbers: updating does not mean you are clean. Plex advises treating any server older than 1.43.3.10861 that was reachable from the internet as possibly compromised. That means a clean reinstall, clearing the Codecs folder, checking the preferences file, signing out all devices and changing the Plex password, and treating anything the Plex account could reach, such as mounted shares and stored credentials, as potentially exposed.
