Plex Media Server flaw is being exploited: apply vendor fixes now
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96654). Apply the vendor's fixes or mitigations as soon as you can.
CISA has added a Plex Media Server flaw, CVE-2026-96654, to its Known Exploited Vulnerabilities catalog. CISA has evidence that it is being exploited.
The problem is in how the server handles encoded web addresses in a page. An attacker could use it to call functions from other plugins and supply their own settings.
This flaw can be chained with three other flaws: CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656. Attackers can combine them, so fixing only one may not be enough.
Who is affected: anyone running Plex Media Server. The facts we have do not list affected or fixed versions. Check the vendor's advisory for those details.
What to do: - Apply the mitigations and updates in Plex's instructions as soon as possible. - Check whether your server is reachable from the internet, and limit that exposure where you can. - Also check for the three related CVEs listed above in the vendor's advisory. - If no mitigation is available, CISA says to stop using the product. - Look for signs of unexpected activity on the server, since exploitation has been confirmed.
We do not know whether this flaw has been used in ransomware attacks. CISA set a due date of 2026-10-23 for US federal agencies. Everyone else should treat that as a good target too.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.