plex

Plex Media Server: Four Flaws Chain Into Unauthenticated Code Execution

Four separate vulnerabilities in Plex Media Server, chained together, let an unauthenticated remote attacker run code with the server process privileges. Plex says the flaws are being actively exploited; CISA added all four to KEV on October 20, 2026.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
Plex Media Server: Four Flaws Chain Into Unauthenticated Code Execution
A home media server box with one status LED glowing red, sitting on a dark TV cabinet in a dim living room. The red LED marks the compromise: an unauthenticated attacker has reached the server's internal surface and is writing a malicious codec file that the server will execute on the next transcode. Rendered with AI.

Four separate vulnerabilities in Plex Media Server, used together, let an attacker on the internet run code with the privileges of the server process. Plex says the flaws are being actively and widely exploited, and CISA added all four to its Known Exploited Vulnerabilities catalog on October 20, 2026. The fix landed in version 1.43.3.10861 (Plex Desktop 1.115.0). If you run Plex on a machine reachable from the internet and it is older than that, treat it as possibly already compromised.

The four flaws

NVD published all four on September 23 (last modified October 21). Here is each one, with the CVSS v4.0 score NVD assigned.

CVE-2026-96652 (CWE-918, CVSS 5.3, MEDIUM). An unauthenticated SSRF in the /player/timeline endpoint. An attacker sends a request with any X-Plex-Token value and puts a full URL in the protocol parameter; the server then POSTs to that URL. The attacker controls the destination. This is the entry point: no valid token, no account, just a reachable server.

CVE-2026-96654 (CWE-84, CVSS 6.9, MEDIUM). The server does not neutralize URL values in the searchOne parameter, so an attacker can call functions belonging to other plugins and supply their own parameters. Plex's advisory frames the impact as access to internal agent functions over the loopback interface. This is the pivot that turns an external SSRF into internal reach.

CVE-2026-96655 (CWE-918, CVSS 5.3, MEDIUM). An authenticated user can request arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. The NVD frames it as authenticated SSRF via the transcode endpoint; Plex's advisory describes the impact as disclosure of the server owner's admin token. The transcode path is the mechanism, and the admin token is what leaks.

CVE-2026-96656 (CWE-73, CVSS 8.6, HIGH). An admin user can write arbitrary files that the server executes on load. The TranscoderH264Options preference is appended verbatim to the x264 option string on every transcode, and at startup every .so file in the Codecs directory is loaded without a signature check, execute-bit check, or symbol check. This is the final step: a file the server will run.

The chain

Individually, three of the four are medium-severity and two require some form of authentication. Chained, they do not. The path runs:

  1. An unauthenticated attacker hits /player/timeline with a crafted protocol value (CVE-2026-96652). The server POSTs to the attacker's chosen destination, which is the attacker's own infrastructure.
  2. The attacker uses the searchOne flaw (CVE-2026-96654) to reach internal agent functions over loopback, stepping from the external network into the server's internal surface.
  3. The attacker reaches the transcode endpoint (CVE-2026-96655) and obtains the server owner's admin token.
  4. With the admin token, the attacker writes a malicious .so file into the Codecs directory via the transcoder preference (CVE-2026-96656). On the next transcode, or on restart, the server loads and executes it.

The end state is code running with the privileges of the Plex Media Server process, on a machine the attacker never authenticated to.

What is happening in the wild

Plex's forum advisory, updated October 20, says the vulnerabilities are being actively and widely exploited. A public proof of concept went out on October 16, and since then Plex reports widespread attacks against internet-facing servers that have not been updated, with compromised servers used to run cryptocurrency miners and proxy software. CISA independently corroborates the exploitation determination with the KEV listing, with federal remediation due dates of October 23 (for 96652 and 96654) and November 3 (for 96655 and 96656).

The active-exploitation claim is Plex's; the KEV listing is CISA's; the NVD records carry the CVSS scores. None of the three is a threat-intel report, so the exploitation picture is vendor- and agency-sourced, not independently confirmed by a third-party IR firm in this cycle.

What to do

Update to 1.43.3.10861 or newer. If the server is older and reachable from the internet, assume it may be compromised: rotate any tokens it held, check for unexpected .so files in the Codecs directory, and look for the telltale signs of a server that has been turned into a miner or a proxy node.

Sources

  • CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • NVD records: https://nvd.nist.gov/vuln/detail/CVE-2026-96652, https://nvd.nist.gov/vuln/detail/CVE-2026-96654, https://nvd.nist.gov/vuln/detail/CVE-2026-96655, https://nvd.nist.gov/vuln/detail/CVE-2026-96656
  • Plex official security advisory (forum): https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

AI/LLM transparency note

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more