CISA Flags Plex Server SSRF and File Write Flaws on KEV List With Looming Federal Patch Deadline

Plex Media Server versions prior to 1.43.3.10861 contain four vulnerabilities that the Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities catalog on October 20, 2026. These flaws allow attackers to manipulate file paths, forge server-side requests, and inject unauthorized parameters into plugin functions.

What happened

The Cybersecurity and Infrastructure Security Agency listed four flaws in Plex Media Server on October 20, 2026, according to CISA KEV catalog entries. CVE-2026-96656 is rated High with a CVSS score of 8.6, while the others range from Medium severity. The vendor product affected is Plex Media Server, and the vulnerable state applies to builds before version 1.43.3.10861.

CVE-2026-96656 permits an administrator to write arbitrary files that the server may execute upon loading, according to the National Vulnerability Database. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

The remaining flaws involve server-side request forgery and improper neutralization of encoded URI schemes. CVE-2026-96655 and CVE-2026-96652 allow authenticated users or those with valid tokens to force the server to POST to attacker-chosen destinations or request internal addresses. CVE-2026-96654 enables attackers to call other plugins' functions with custom parameters via the searchOne value.

Why it matters

These vulnerabilities were added to the federal Known Exploited Vulnerabilities catalog, which triggers specific compliance requirements for federal entities. CISA set federal due dates of October 23, 2026, for CVE-2026-96656 and CVE-2026-96654, and November 3, 2026, for the SSRF flaws. Stakeholders must evaluate internet exposure and follow BOD 26-04 guidance.

The ability to chain these flaws increases the potential impact of an attack. An attacker could use the SSRF or URI neutralization issues to position themselves for the arbitrary file write in CVE-2026-96656. This combination allows for code execution on the server, which is a severe outcome for media server infrastructure.

What to watch

• Monitor vendor communications for an update that addresses version 1.43.3.10861.
• Review CISA BOD 26-04 guidance for prioritizing security updates based on risk.
• Check for any public disclosures regarding ransomware usage of these CVEs.
• Assess internal network segmentation to limit lateral movement from media servers.

Who needs to act first

Teams should prioritize systems that are directly exposed to the internet or accessible to untrusted users. Check whether your deployment allows admin-level access to external users, as this elevates the risk of file-write attacks. Roll out updates in a staged manner, testing compatibility with existing media libraries first. Back up configuration files before applying changes to prevent service disruption. Reduce exposure by restricting network access to the server if immediate patching is not possible.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe

• Identify all instances of Plex Media Server running versions prior to 1.43.3.10861.
• Restrict administrative access to trusted networks and enforce strong authentication.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.