TL;DR: Four Plex Media Server flaws, CVE-2026-96652, -96654, -96655 and -96656, allow unauthenticated remote code execution when chained. Plex shipped the fix in September, and CISA added all four to KEV on Oct 20. If your server is older than 1.43.3.10861 and reachable from the internet, assume it's compromised. (Plex, CISA KEV)
| Item | Detail | Source |
|---|---|---|
| CVEs | CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Plex |
| Impact | Chained, they allow unauthenticated RCE | Plex |
| Exploitation | CISA added all four to KEV on Oct 20 | CISA KEV |
| Fix | Shipped in September; versions older than 1.43.3.10861 are exposed | Plex |
What to do
- Make sure the server runs 1.43.3.10861 or later.
- If an older version was internet-facing, treat the host as compromised rather than just patching it.
Last verified 2026-10-20Report an error: [email protected]