CISA Adds Actively Exploited Plex Media Server Chain to KEV
Tech GuruQuick Answer
CISA added four Plex Media Server vulnerabilities to KEV after Plex reported active, widespread exploitation. Update affected servers to 1.43.3.10861 or later, preserve evidence, and investigate internet-facing systems for miner, proxy, file, process, account, and outbound-network indicators.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Plex Media Server deployments and exposure; preserve volatile and host evidence; update to 1.43.3.10861 or later; investigate the vendor indicators; and rebuild, revoke sessions, rotate credentials, and assess reachable resources when compromise cannot be ruled out.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Plex Media Server |
|---|---|
| Advisory | Plex Security Update 2026-10-19 / CISA KEV: CVE-2026-96652 / CVE-2026-96654 / CVE-2026-96655 / CVE-2026-96656 |
| CVEs | CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 |
| CISA KEV addition date | 2026-10-20 at 19:00:31 UTC (CISA KEV addition) |
| Latest Plex material revision | 2026-10-20 at 14:34:13 UTC; Plex's original notice was published 2026-09-01 at 18:30 UTC |
| Affected versions | Plex Media Server versions before 1.43.3.10861; internet-facing servers in this range require compromise assessment in addition to updating. |
| Fixed version | Plex Media Server 1.43.3.10861 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Plex reports active and widespread exploitation; CISA confirms evidence of active exploitation; known ransomware campaign use is unknown.; this status is confirmed by the cited authorities. |
What Changed
Plex mapped four flaws that can be chained by an unauthenticated remote attacker to run code with the Plex Media Server process privileges. Plex reports widespread exploitation against unpatched internet-facing servers, including cryptocurrency miners and proxy software; CISA added all four CVEs to KEV.
What To Validate Now
- Inventory. Identify Plex Media Server instances, exact versions, internet reachability, service accounts, Codecs directories, mounted shares, stored credentials, and account owners.
- Establish applicability. Treat Plex Media Server before 1.43.3.10861 as affected. Plex says an affected internet-reachable server should be assumed compromised; do not infer applicability or a clean state from normal playback alone.
- Remediate. Install Plex Media Server 1.43.3.10861 or later from the supported channel. If compromise cannot be ruled out, rebuild from a clean installation without reusing the old data directory, sign out all devices, change the Plex password, and review exposed credentials and shares.
- Validate. Confirm the resulting version and remote-access configuration; review child processes, the Codecs directory, Preferences.xml, CPU use, and outbound contact including proxystream.st; retain triage results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Plex says internet-facing servers older than 1.43.3.10861 should be assumed compromised. Updating closes the known chain but does not remove persistence or undo account, share, or credential exposure. The CISA due dates are October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for CVE-2026-96652 and CVE-2026-96655, for in-scope federal systems.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- Plex Security Update 2026-10-19
- CISA KEV: CVE-2026-96652 / CVE-2026-96654 / CVE-2026-96655 / CVE-2026-96656
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
