plex
Plex Media Server: Four Flaws Chain Into Unauthenticated Code Execution
Four separate vulnerabilities in Plex Media Server, chained together, let an unauthenticated remote attacker run code with the server process privileges. Plex says the flaws are being actively exploited; CISA added all four to KEV on October 20, 2026.