Four Plex Media Server Flaws Hit CISA KEV With Tight Patch Windows

The Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities in Plex Media Server to its Known Exploited Vulnerabilities catalog on October 20, 2026. These flaws affect versions prior to 1.43.3.10861 and allow attackers to execute code or probe internal networks. Federal systems have until October 23 or November 3 to apply mitigations.

Which flaws are on the list?

CISA listed CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, and CVE-2026-96652. The highest-severity issue, CVE-2026-96656, is a path traversal flaw rated high. It lets admin users write arbitrary files that the server may execute upon loading. The other three are medium-severity issues involving server-side request forgery and improper URI neutralization.

How do the flaws chain together?

The National Vulnerability Database notes that CVE-2026-96656 can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. CVE-2026-96652 allows an attacker with any X-Plex-Token to force the server to POST to chosen destinations. CVE-2026-96655 lets authenticated users request arbitrary addresses via the transcode path parameter.

What are the specific technical details?

CVE-2026-96654 involves improper neutralization of encoded URI schemes, allowing attackers to call other plugins' functions with custom parameters. According to the NVD, this occurs in the 'searchOne' function. CVE-2026-96655 and CVE-2026-96652 are both server-side request forgery flaws. CVE-2026-96655 requires authentication, while CVE-2026-96652 exploits the timeline path with any token value.

What are the federal deadlines?

CISA set a federal due date of October 23, 2026, for CVE-2026-96656 and CVE-2026-96654. For the SSRF flaws CVE-2026-96655 and CVE-2026-96652, the deadline is November 3, 2026. Agencies must follow BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. No ransomware use has been confirmed for these flaws.

Detection notes

Teams should monitor web server logs for unusual POST requests to internal IP ranges or unexpected external domains, which may indicate SSRF activity. Check for unauthorized file creation in temporary or transcode directories, especially files with executable extensions. Look for spikes in CPU usage during transcoding tasks that do not correspond to active user sessions. Review access logs for the use of generic or reused X-Plex-Token values from unknown IPs.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Plex

• Inventory all Plex Media Server instances and verify their version numbers against the affected range.
• Restrict network access to Plex servers from untrusted networks to limit SSRF attack surfaces.
• Monitor file system changes in directories used for transcoding and temporary storage.
• Prepare to apply vendor updates or mitigations once available to meet federal deadlines.

Step-by-step guide: Ransomware Response: Steps to Contain, Recover, and Prevent Recurrence

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVEs were added to the KEV catalog?

CISA added CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, and CVE-2026-96652 on October 20, 2026.

What is the severity of the file write vulnerability?

CVE-2026-96656 has a CVSS score of 8.6, which is rated as high severity.

Are there confirmed ransomware attacks using these flaws?

CISA lists ransomware use as unknown for all four vulnerabilities in the KEV catalog.