CISA Gave Federal Agencies Three Days on Two Plex Flaws and 14 on Two Others in the Same Exploit Chain

A remote attacker holding any value as an X-Plex-Token header can chain four Plex Media Server flaws into code execution as the server's own user, on any build older than 1.43.3.10861. CISA added all four, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, to its Known Exploited Vulnerabilities catalog on October 20, 2026.

Update to Plex Media Server 1.43.3.10861 or later, and treat any older server reachable from the internet as suspect. Plex's own security announcement says 1.43.3.10861 and later are not affected.

Two deadlines inside one chain

CISA's catalog entries carry different due dates for flaws that its own text says chain together. CVE-2026-96654 and CVE-2026-96656 are due October 23, three days after listing. CVE-2026-96652 and CVE-2026-96655 are due November 3. Only CVE-2026-96656 is flagged for forensic triage under the agency's binding operational directive BOD 26-04, and the ransomware-use field reads "Unknown" for all four.

1. CVE-2026-96656 file write8.6 CVSS
2. CVE-2026-96654 plugin call6.9 CVSS
3. CVE-2026-96652 SSRF5.3 CVSS
4. CVE-2026-96655 SSRF5.3 CVSS

Source: The Hacker News, October 19, 2026

The score understates the chain. The Hacker News reports the individual ratings above, none of which reads as an emergency alone. In sequence they work like this, per the catalog and the article. CVE-2026-96652 lets the server be forced to POST to an attacker's address through an unvalidated protocol parameter. CVE-2026-96654 calls other plugins' functions and yields the owner's admin token. CVE-2026-96655 fetches an attacker-hosted video that carries an ELF payload. CVE-2026-96656 writes a shared object into the Codecs directory, where it runs.

Security Affairs traces the last step to the library loader: it does not check the library's name, permissions, signature or symbols, and an ELF constructor runs before symbol resolution. A second transcode loads the file and the code runs as uid=1000(plex).

Timeline, and where the sources disagree

• July 27: researcher Zach Main reports the flaws to Plex.
• August 3 or September 1: the fix ships, depending on the source.
• October 16: Main publishes technical details and proof-of-concept code.
• October 17: first exploitation seen on a honeypot.
• October 19: Plex publishes CVE details and reports active exploitation.
• October 20: CISA lists all four.

The patch date is disputed. The Hacker News says Plex fixed the bugs on August 3 in build 1.43.3.10861. Plex's announcement says 1.43.3 and Desktop 1.115.0 were released on September 1. Security Affairs says only that fixes came in September, before the exploit was public. Either way the exposure window ran at least six weeks before the proof of concept appeared.

What the attacks install

The honeypot reports come from a researcher using the alias boredhackerblog, per The Hacker News, which gives no real name. A shell script pulls a payload from 217.60.194[.]116. It deploys an XMRig cryptominer called mylovelyminer and a Linux reverse proxy called myawesomeproxy, which VirusTotal describes as a stealthy backdoor. The miner's server points at ota.proxystream[.]st. Bitsight flagged a sibling subdomain, global.relay.proxystream[.]st, in August in connection with the AISURU DDoS and proxyware botnet.

Security Affairs said the honeypot needed outbound traffic enabled, so some payloads may have been missed, and that the findings do not show how many real servers were compromised. Plex users on Reddit report the same miner, though The Hacker News says it is unknown whether those cases come from this chain.

What Plex tells owners to check

Plex's list is specific: unrecognised processes launched by the server, unfamiliar .so or .dll files in the Codecs folder, outbound connections to proxystream.st, and high CPU use when nothing is playing. For a compromised or uncertain server it advises a clean reinstall rather than reuse of the old data directory, signing out of all devices and changing the Plex password. It also advises disabling remote access if unneeded and not forwarding port 32400.

Related coverage of patch windows includes AWS's PHP bulletin and the Lightsail instances with no in-place patch and GitLab's second CVSS 10.0 fix. The Hacker News said it had asked Plex for comment and would update if Plex replied. No reply appears in its article. The next date to watch is November 3, when the second pair of Plex entries falls due.