Vulnerability Description
CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 are four flaws in Plex Media Server before build 1.43.3.10861 that chain into remote code execution as the account running the server. Scored individually they look less severe: CVE-2026-96656, an arbitrary file write through the transcoder preferences, is the highest at 7.2, CVE-2026-96654 is 6.5, and CVE-2026-96652 and CVE-2026-96655 are 4.3 each.
Together they are more serious than any single score suggests, because the flaw scored 7.2 requires admin access, and the earlier flaws give an unauthenticated attacker that access. The researcher (code-zm on GitHub) described the chain in the Plex2Shell write-up. An unauthenticated request to /player/timeline makes the server issue requests on the attacker’s behalf. A crafted searchOne value then forces a request to an internal agent over loopback, and Plex attaches the owner’s admin token to it. With that token, the attacker sets the x264 transcoder options so that a transcode of a crafted video writes a shared object into the Plex Codecs directory, which Plex loads without signature checks.
Impact
Public exploit code demonstrates code execution as the user account running Plex Media Server, starting from an unauthenticated request. Plex’s October 19 update to its security notice reports that compromised servers have been used to run cryptocurrency miners and proxy software, and a honeypot operator observed the same, including a proxy tool whose own banner claims “external use of your internet traffic”. The exposure reaches past the server: Plex advises treating anything the Plex service account could reach, such as mounted shares and credentials stored on the same machine or VM, as potentially exposed.
Upgrading closes the chain but does not remove an implant already in the Codecs directory or revoke a disclosed admin token. Plex says a server older than 1.43.3.10861 that was reachable from the internet should be treated as one that may be compromised, and recommends a clean reinstall, clearing the Codecs folder, checking Preferences.xml for unexpected transcoder options, signing out all devices, and changing the Plex password.
Details
| Field | Description |
| CVE-ID | CVE-2026-96656, CVSS 7.2 (High); CVE-2026-96654, CVSS 6.5 (Medium); CVE-2026-96652 and CVE-2026-96655, CVSS 4.3 (Medium). Assigned by CISA. |
| Date of Disclosure | Plex security notice: September 1, 2026 (updated October 19, 2026). NVD: September 23, 2026. Plex2Shell write-up: October 16, 2026. |
| Affected Assets | Plex Media Server on all platforms, including NAS packages and container images. The CVE records name no other Plex product. |
| Vulnerable Software Versions | All four CVEs: Plex Media Server before 1.43.3.10861. Earlier 1.43.3 builds, including 1.43.3.10828, are affected. |
| PoC Available | Yes. The researcher published the Plex2Shell write-up and exploit code on October 16, 2026; copies have since appeared on GitHub. |
| Exploitation Status | Plex reported active, widespread exploitation on October 19, 2026. A honeypot operator first observed it on October 17, one day after the chain was published. |
| Patch Status | Fixed in Plex Media Server 1.43.3.10861 and later, released August 4, 2026. Plex’s notice describes automatic updates for Windows and macOS when enabled; Linux, NAS, and Docker installations need a manual update. |
Censys ARC Perspective
Censys observes roughly 324,000 hosts running Plex Media Server. The largest networks are residential broadband providers, and the United States accounts for about 44 percent. About 30 percent run a vulnerable build. Nearly 8,000 hosts run an early build of the release line Plex’s original notice named as the fix, which makes them the hosts most likely to be mistaken for patched.
Censys retains daily host history, so we classified every Plex host as fixed or vulnerable on each day from early July through October 18 to see how the population responded to each stage of disclosure. The fixed build appeared in our data on its release day, August 4, and nearly 30 percent of the population moved within a week, which is expected since automatic updates are often enabled. However, half the population was still vulnerable when Plex published its notice, and about 32 percent the day before the chain went public. Population share alone can confuse patching with hosts changing address, so we also followed individual IP addresses. Of the hosts that were vulnerable at the time of the vendor notice and are still observed at the same address, about 40 percent have since upgraded.
In the first three days, publication of a working chain, and exploitation reported the next day, did not speed patching. Under 2 percent of still-vulnerable hosts upgraded in that window, below the rate in the two matching three-day windows the preceding weeks. The servers that remain vulnerable are the ones that did not respond to the fix, the vendor notice, or NVD publication, and the attention the exploit has drawn has not yet reached them either. The Censys Rapid Response team notified customers of potentially vulnerable instances in their attack surfaces.
Censys Queries
Platform: Found: 323,583 hosts
ASM: