Plex published a security notice on 1 September 2026 without naming a single CVE. By 20 October, CISA had added four identifiers to its exploited catalog and the vendor was telling owners of exposed servers to assume compromise. The gap between those two statements is the part worth studying.

1 September: a release note with no identifiers

Plex announced Plex Media Server 1.43.3 and Plex Desktop 1.115.0, stating that the release addressed a number of security issues and recommending that all server owners update. The notice said CVEs had been requested and would be added to the thread once published. It also listed update instructions per platform and warned that not all app stores would carry the build immediately.

That is an ordinary disclosure pattern for a vendor that wants patched binaries in place before exploit detail becomes public. For defenders it also means a version number alone was the signal available in September.

23 September: four records appear

NVD published CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 on the same day. Their scores from a secondary CVSS source are 4.3, 6.5, 4.3 and 7.2.

Each record describes a distinct mechanism: an unauthenticated SSRF in /player/timeline that accepts any X-Plex-Token value; incorrect neutralization of URL values in searchOne; an address request through the transcode path parameter; and an arbitrary file write through the TranscoderH264Options preference into a Codecs directory whose .so files are loaded without signature checks. All four name the same affected range: before 1.43.3.10861.

Nothing in the four records states that they chain. That conclusion comes from the vendor.

16 October: a public proof of concept

Plex reports that a public proof of concept for the chain appeared on 2026-10-16. That date matters for two reasons. It marks the point where the exploit stopped being private, and it precedes CISA's catalog entry by four days.

19 October: the vendor confirms exploitation

Plex updated the same thread with the CVE table and a blunt assessment. Chained together, the issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. Servers on 1.43.3.10861 or later are not affected.

The update also records what attackers did with the access: cryptocurrency miners and proxy software that routes other people's traffic through the victim's connection. It names process examples, myawesomeproxy, mylovelyminer and x12345, tells operators to look for unfamiliar .so or .dll files in the Codecs folder and for outbound connections to proxystream.st, and advises anyone running an older build behind the internet to assume compromise.

That last sentence is the strongest statement in the whole timeline, because it converts a patching task into an incident response task for a population of unknown size.

20 October: CISA adds all four

The Known Exploited Vulnerabilities catalog entry dated 2026-10-20 lists the four identifiers with Plex and Media Server as vendor and product. The required action points to vendor mitigations and to BOD 26-04 guidance. The deadlines split the chain: 2026-10-23 for CVE-2026-96656 and CVE-2026-96654, and 2026-11-03 for CVE-2026-96652 and CVE-2026-96655. CVE-2026-96656 also carries a forensic triage requirement. The catalog describes all four as chainable with each other, matching the vendor's account.

What the timeline says about preparation

Three observations follow from the dates rather than from the exploit detail.

First, the release preceded the identifiers by three weeks. An organisation that tracks only CVE feeds learned nothing on 1 September, while one that tracks vendor release notes could have staged the update.

Second, the exploitation report came from the vendor, not from a third-party research publication. Reading the advisory thread itself, not only its first post, was the way to learn that the flaw had moved from theoretical to active.

Third, the KEV deadline for two of the four CVEs was three days after the listing. That is not enough time for a change board to approve work across a large fleet, which argues for pre-authorising updates to internet-facing media servers.

What to do with a host today

Check the version in Plex Web under Settings, then General, and compare the full build string against 1.43.3.10861. Turn off remote access that nobody uses, and avoid forwarding port 32400 directly.

For a server that was exposed on an older build, work through the compromise checks and prefer a rebuild from a clean installation to cleaning a host in place. Sign out all devices, change the Plex password, and treat mounted shares and stored credentials reachable from the service account as exposed.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared, while vul.cve="CVE-2026-96654" returned 0. The product figure counts reachable installations at a point in time, not hosts that were unpatched during the window this timeline describes.

References

  • Plex security notice and 19 October update: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

  • CVE-2026-96652 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96652

  • CVE-2026-96654 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96654

  • CVE-2026-96655 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96655

  • CVE-2026-96656 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96656

  • CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654