What happened
Verified on the Plex forum post (the vendor's security update; thread updated with CVE details and exploitation status): the four CVEs chain to unauthenticated remote code execution; the vendor states the flaws 'are being actively and widely exploited', a public PoC was released Oct 16, and compromised servers have been observed running cryptocurrency miners and proxy software. CISA added all four to KEV on 2026-10-20 with confirmed in-the-wild exploitation. Non-AI consumer-media-server item retained per KEV coverage policy.
Why it matters
Non-AI KEV, but it is a live, mass-exploited unauthenticated-RCE chain with an Oct 16 public PoC — one of the clearest 'patch now or assume breached' signals in the reporting window, and Plex servers frequently sit on the same LAN/VLAN as home-lab AI/GPU workstations.
Attack vector
Chained: CVE-2026-96652 unauthenticated SSRF in the player timeline endpoint; CVE-2026-96654 access to internal agent functions over loopback; CVE-2026-96655 disclosure of the server owner's admin token; CVE-2026-96656 arbitrary file write into the Codecs directory via transcoder preferences — together giving an unauthenticated remote attacker code execution in the Plex Media Server process.
Affected systems
Plex Media Server < 1.43.3.10861 (fixed 1.43.3.10861+, Plex Desktop 1.115.0); NAS/Docker/NVIDIA Shield packages per vendor
Mitigation
Update Plex Media Server to 1.43.3.10861 or later immediately (per vendor forum post, fetched); check for miner/proxy processes (myawesomeproxy, mylovelyminer, x12345), unfamiliar .so/.dll in the Codecs folder, outbound to proxystream.st; if compromised, rebuild from clean install, sign out all devices, change Plex password; disable remote access / avoid forwarding port 32400 if not needed. Federal due date 2026-10-23 (96652/96654/96656).