Plex vulnerabilities in CISA KEV
Plex has 5 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 52nd highest of any vendor. 4 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 14 days (range 3 to 21), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Media Server, with 5 entries.
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor plex --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
5
in CISA KEV
┌─ first added
2023-03-10
earliest entry
┌─ latest added
2026-10-20
most recent entry
┌─ last 12 months
4
entries added
┌─ ransomware use
0 of 5
0% linked to ransomware
┌─ distinct products
1
affected products
$ awk -F, {print $1} /var/log/kev/plex.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2023 | 1 | 0 |
| 2026 | 4 | 0 |
$ sort /var/log/kev/plex.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Media Server 5 entries
$ kev-due-dates --vendor plex
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Plex
14 days (range 3 to 21)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/plex.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (5 of 5 have at least one CWE).
$ grep -ril 'Plex' /var/log/news | head -5
Our reporting that names Plex or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./plex.kev · 5 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-96652
Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
due 2026-11-03 · CWE-918
$ cat CVE-2026-96652.txt
Description. Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-96654
Media Server
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
due 2026-10-23 · CWE-84
$ cat CVE-2026-96654.txt
Description. Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-96655
Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
due 2026-11-03 · CWE-918
$ cat CVE-2026-96655.txt
Description. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-96656
Media Server
Plex Media Server External Control of File Name or Path Vulnerability
due 2026-10-23 · CWE-73
$ cat CVE-2026-96656.txt
Description. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2020-5741
Media Server
Plex Media Server Remote Code Execution Vulnerability
due 2023-03-31 · CWE-502
$ cat CVE-2020-5741.txt
Description. Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Required action. Apply updates per vendor instructions.