Key points
- Plex Media Server versions before 1.43.3.10861 contain four security flaws.
- The U.S. Cybersecurity and Infrastructure Security Agency added these to its Known Exploited Vulnerabilities catalog on October 20, 2026.
- The flaws include a high-severity path traversal issue and three medium-severity issues involving server-side request forgery and improper neutralization.
Plex Media Server versions prior to 1.43.3.10861 are affected by four security vulnerabilities that the U.S. Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities catalog on October 20, 2026. Administrators using these older versions must update their software to address risks that could allow attackers to execute arbitrary files or manipulate server requests.
In plain English
One of the flaws, CVE-2026-96656, allows an admin user to write arbitrary files that may be executed when the server loads. The National Vulnerability Database rates this issue as high severity with a CVSS score of 8.6. The other three flaws, CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655, are rated medium severity. These issues involve server-side request forgery and improper handling of URL schemes, which could let attackers call other plugins' functions or force the server to POST to chosen destinations.
The background
CISA noted that these vulnerabilities can be chained together, meaning an attacker might use one flaw to exploit another. The agency added all four entries to the catalog on the same day, setting federal due dates for compliance. CVE-2026-96656 and CVE-2026-96654 have a federal due date of October 23, 2026. CVE-2026-96652 and CVE-2026-96655 have a later federal due date of November 3, 2026.
What changes now
Organizations must apply mitigations in accordance with vendor instructions to remain compliant with CISA’s Binding Operational Directive 26-04. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to patching guidelines. If mitigations are unavailable for cloud services, CISA advises discontinuing use of the product. The agency also points to its Forensics Triage Requirements for further guidance on handling potential incidents.
Who needs to act first
Teams should prioritize updating servers that are directly exposed to the internet, as these face the highest risk of exploitation. Before applying updates, verify that current configurations and plugins are backed up to prevent data loss during the process. Test the update in a non-production environment first to ensure it does not disrupt critical workflows. If immediate patching is not possible, restrict access to the server using strict firewall rules and limit administrative credentials to reduce the attack surface.
What to do and how to stay safe: Plex Media Server
- Check your Plex Media Server version and update to at least 1.43.3.10861 once the vendor provides an update.
- Review server logs for unusual activity, such as unexpected file writes or outbound POST requests to unknown destinations.
- Restrict administrative access to trusted networks and enforce strong authentication for all admin accounts.
- Monitor official security advisories from Plex and CISA for further updates on these vulnerabilities.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Plex Media Server versions are affected?
Versions before 1.43.3.10861 are affected by these four vulnerabilities.
What is the severity of CVE-2026-96656?
The National Vulnerability Database rates CVE-2026-96656 as high severity with a CVSS score of 8.6.
Can these vulnerabilities be used together?
Yes, CISA noted that these vulnerabilities can be chained, allowing attackers to potentially combine them for greater impact.
