CVE-2026-96654: Plex Media Server flaw is one link in an actively exploited RCE chain

CoeLab Real-World Impact: 87/100 — Urgent. Editorial score v1.0. Evidence checked 2026-10-22T14:12:07.049246+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 30, reachability: 25, consequences: 17, operational relevance: 15.

Who is affected

CVE-2026-96654 affects Plex Media Server releases earlier than 1.43.3.10861. The CVE record marks 1.43.3.10861 as unaffected, and Plex says that version and later are not affected by the set of issues discussed in its security notice. Administrators should verify the complete build number in Plex Web under Settings and General rather than relying only on the shorter 1.43.3 family number.

The highest-risk group is operators whose older Plex Media Server can be reached from the internet, especially through remote access or a directly forwarded port. Plex explicitly advises operators of an internet-reachable server older than 1.43.3.10861 to assume it may be compromised. A server that is not internet-accessible has less exposure to the remote campaign Plex describes, but it remains affected software and should still be updated. Plex also announced a separate Plex Desktop update in the same September notice, but the affected-version statement for this CVE specifically identifies Plex Media Server.

The vulnerability was publicly identified before the current exploitation alert. The CVE record lists August 3, 2026 as its public date, September 23 as the CVE publication date, and October 21 as the latest record update. Plex first posted its broader security update on September 1 and added detailed CVE and exploitation information on October 19. CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog on October 20. The recent news is the confirmed exploitation and KEV addition, not the discovery of a brand-new vulnerability.

Real-world impact and exploitation evidence

Plex says these vulnerabilities are being actively and widely exploited against internet-facing servers that have not been updated. According to the vendor, compromised systems have been used to run cryptocurrency miners and proxy software, allowing other people's traffic to pass through the victim's connection. Plex also says a public proof of concept appeared on October 16. CISA's October 20 KEV addition independently establishes that CVE-2026-96654 has evidence of exploitation in the wild, although the catalog does not attribute a campaign or say ransomware use is known.

It is important not to inflate the impact of this individual CVE. CVE-2026-96654 is a URL-neutralization flaw that can expose internal agent functions over the loopback interface. Its published CVSS 4.0 score is 6.9, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. The CVE record also provides a CVSS 3.1 score of 6.5. Plex describes remote code execution as the result of chaining CVE-2026-96654 with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656. This component should therefore not be described as independently granting unauthenticated remote code execution.

The CoeLab Real-World Impact score is 87 out of 100, labeled Urgent. That is not CVSS and it is not EPSS. Its 30 exploitation points come from KEV membership; 25 reachability points reflect the published network, low-complexity, no-privilege and no-interaction metrics; 17 consequence points are derived from the 6.9 CVSS base score; and 15 operational-relevance points reflect the product's infrastructure role. The score helps prioritize editorial review, but it does not measure any reader's actual exposure, prove every vulnerable server is exploitable, or replace the vendor's chain-specific analysis.

Attack prerequisites

The published vector says the vulnerable function is reachable over a network with low attack complexity, no prior privileges and no user interaction. In the observed remote-code-execution scenario, however, CVE-2026-96654 is only one stage. Plex says attackers combine it with three other flaws: a server-side request forgery in a player timeline endpoint, disclosure of the server owner's administrative token, and an arbitrary file write through transcoder preferences. The successful chain ultimately runs code with the privileges of the Plex Media Server process.

Practical exposure also depends on whether an attacker can reach the server. The vendor's warning and observed campaign focus on internet-facing systems. Direct forwarding of Plex's default service port increases reachability, while disabling unneeded remote access is a useful exposure reduction. Network isolation is not a substitute for installing a fixed build, and it cannot establish that a previously exposed server was never compromised.

Actions and fixes

Update Plex Media Server to 1.43.3.10861 or later. Plex's current guidance is to check the installed version in Plex Web and use the platform-appropriate package or update path. NAS package repositories may lag, so Plex advises using the correct manual package when the vendor store has not yet supplied a fixed release. For Docker installations, update through the maintained image workflow rather than modifying the running container in place.

Operators of previously exposed vulnerable servers should also investigate for compromise. Plex identifies unfamiliar child processes, unknown shared-library or DLL files in the Codecs directory, connections to proxystream.st, and unexplained sustained CPU usage as warning signs. These are indicators to examine, not a complete detection list. If compromise is found or cannot be ruled out, Plex recommends rebuilding from a clean installation instead of reusing the old Plex data directory, signing out all devices, changing the Plex account password, and treating resources reachable by the Plex service account as potentially exposed.

If remote access is unnecessary, disable it in Plex settings and remove direct port forwarding. That is a practical mitigation for remote reachability, but the durable fix remains upgrading. A clean version check after the update is especially important on NAS appliances and other platforms where package availability or deployment automation may not match the expected release.

Uncertainty and what could change

Plex has confirmed widespread attacks and named observed miner and proxy behavior, but it has not published a complete campaign timeline, victim count, attacker attribution or exhaustive indicators of compromise. CISA lists known exploitation, while known ransomware campaign use remains unknown. Absence of the specific indicators in Plex's notice therefore does not prove a server is clean.

The CVE record's August 3 public date should not automatically be treated as the researcher's discovery date; the primary sources reviewed here do not provide a distinct discovery date. Additional forensic guidance, indicators, platform-specific fixed packages or details about how each flaw participates in the chain may emerge. Administrators should follow the Plex advisory for updates and use the exact fixed build threshold rather than relying on headlines or the standalone CVSS rating.

Sources and evidence date

Evidence was checked on October 22, 2026 against Plex's official security announcement, the official CVE record and CISA's Known Exploited Vulnerabilities entry. Plex's post was originally dated September 1 and updated with CVE and exploitation details on October 19. The CVE was published September 23, last updated October 21, and added to KEV on October 20. Those dates describe different events and should not be collapsed into a single disclosure date.

Primary-source links

https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

https://www.cve.org/CVERecord?id=CVE-2026-96654

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology