Plex Media Server SSRF (CVE-2026-96652) is exploited — patch to 1.43.3.10861

CISA added CVE-2026-96652 — a server-side request forgery (SSRF) in Plex Media Server — to its Known Exploited Vulnerabilities catalog today, with a federal remediation deadline of November 3, 2026. On its own the bug is scored medium. That is exactly why it is dangerous: it is the quiet first step of a four-bug chain that ends in unauthenticated code execution on the server, and unpatched internet-facing instances are already being turned into cryptominers and proxy nodes.

Developing story — first published 21:56 CEST (19:56 UTC), October 20, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-96652 (CWE-918, SSRF)
Product / affected versions	Plex Media Server before 1.43.3.10861
Fixed in	1.43.3.10861 (released September 1, 2026); Plex Desktop 1.115.0
CVSS	5.3 Medium (CVSS 4.0) · 4.3 Medium (CVSS 3.1), both assigned by the CNA; NVD has not added an independent score
Exploited in the wild	Yes — Plex states the chain is "actively and widely exploited"; CISA KEV
CISA KEV	Added 2026-10-20; federal due date 2026-11-03 (BOD 26-04)
Public PoC	Yes — researcher write-up and PoC published 2026-10-16
Official advisory	Plex Media Server security update

What happened

Plex shipped the fix quietly on September 1, 2026, in Plex Media Server 1.43.3.10861 and Plex Desktop 1.115.0. For six weeks it read like a routine maintenance release. Then on October 16 the researcher who reported the bugs — publishing as zmain — released a full write-up and a working proof-of-concept named "Plex2Shell". Within days, mass exploitation of unpatched servers began, and on October 19 Plex updated its advisory to state the vulnerabilities are "actively and widely exploited." CISA listed CVE-2026-96652 on October 20.

The gap between a silent patch and a public PoC is the entire incident. The fixed version has existed since September 1; the people who pulled the diff and reconstructed the chain did not wait. If your server has been reachable from the internet and running anything older than 1.43.3.10861 since mid-October, Plex's own guidance is to assume it is compromised.

How a medium SSRF becomes remote code execution

Read in isolation, CVE-2026-96652 is unremarkable. The /player/timeline endpoint builds a callback URL from client-supplied protocol, host, and port values and never validates them. On WAN requests it only checks that an X-Plex-Token header is present — the value is never verified, so any junk string passes. Put a full loopback URL in protocol and the server POSTs to a destination you choose. The attacker cannot read the response. By itself, that is a 4.3.

The chain is what the CISA KEV entry flags when it notes CVE-2026-96652 "can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656." The researcher's write-up lays out the stages:

• SSRF to the loopback API. The blind SSRF reaches 127.0.0.1:32400, where the /system/agents/* plugin API trusts loopback callers and skips token checks. A flaw in an identifier check lets the attacker invoke arbitrary plugin functions.
• Owner admin-token theft. A bundled metadata-agent function fetches URLs and attaches the owner's admin token to any URL beginning with the loopback prefix. A crafted hostname that starts with 127.0.0.1. leaks the token back to the attacker.
• Arbitrary file write. With admin rights, the attacker changes a transcoder preference so the transcoder writes attacker-controlled bytes into the Codecs directory.
• Code execution. The server loads .so files from that directory at transcoder startup. The planted library runs as the plex service account.

An unauthenticated request to a "media server" ends as native code execution. No credential is ever guessed; the only thing the attacker needed was that the SSRF existed and the server was reachable. This is why CVSS triage alone keeps failing on chains: each link is survivable, and the sum is not.

Who is exposed

Any Plex Media Server older than 1.43.3.10861 that is reachable from the internet — most commonly a home or small-business server with port 32400 forwarded, or Remote Access left on. The exploit needs no valid credentials and no valid token value. Plex reports that compromised servers have been running cryptocurrency miners and proxyware, with observed artifacts including unfamiliar processes spawned by the server (Plex gives myawesomeproxy, mylovelyminer, x12345 as examples), rogue libraries in the Codecs folder, and outbound traffic to proxystream.st.

Check your version under Settings → General in Plex Web. If it reads 1.43.3.10861 or later, you are not affected by this chain.

Remediation

Grounded in the Plex advisory and the public write-up. Patching closes the door; it does not evict anyone already inside.

1 — Am I affected? Confirm the running version (Settings → General). Determine internet exposure: is Remote Access enabled, or is TCP 32400 forwarded to the server? An internet-reachable server below 1.43.3.10861 after mid-October is the high-risk case.

2 — Patch (exact fixed versions). Upgrade Plex Media Server to 1.43.3.10861 or newer; update Plex Desktop to 1.115.0. "1.43.3.10861 and later are not affected."

3 — Can't patch immediately? Compensating controls. Disable Remote Access (Settings → Remote Access) and stop forwarding port 32400 at the router. Place the server behind a VPN or an authenticating reverse proxy. Because the SSRF only requires the server to be reachable, removing WAN exposure removes the attack surface until you patch.

4 — Hunt for compromise (indicators from vendor + researcher). Map to MITRE ATT&CK:

• Initial access (T1190): inbound WAN requests to /player/timeline carrying arbitrary X-Plex-Token values; player subscribe/unsubscribe traffic with loopback URLs in the protocol field; outbound requests to hostnames of the form 127.0.0.1.<something> (sslip.io-style names).
• Credential access (T1552.001): unexpected use or exposure of the owner admin token.
• Execution / persistence (T1574): new or unfamiliar .so/.dll files in the Codecs directory; unexpected changes to the TranscoderH264Options preference in Preferences.xml; transcode requests whose path parameter points at external HTTP URLs.
• Impact (T1496 / T1090): unexplained high CPU with nothing playing (miner); outbound connections to proxystream.st or unknown proxy endpoints; unknown processes spawned by the Plex process.

5 — Eradicate and verify. If compromise is found or cannot be ruled out, Plex's guidance is to rebuild from a clean installation rather than reuse the existing data directory. At minimum, delete the contents of the Codecs folder and review Preferences.xml for transcoder options you did not set. Sign out of all devices in your Plex account and change your Plex password. Treat any share, mount, or credential the Plex service account could reach as potentially exposed and rotate it. Re-verify after patching — a clean scan on an unpatched box proves nothing.

What is not known yet

• Whether ransomware operators are using the chain. CISA records known ransomware use as "Unknown" as of the October 20 listing.
• The scale of compromise. Plex says "widely exploited" but has not published a server count.
• Attribution of the crews deploying the miners and proxyware.
• Whether NVD will diverge from the CNA's medium scores once it completes its own analysis.

This story will be updated as those gaps close.

Why chains beat severity scores — and what actually answers them

The practical lesson of CVE-2026-96652 is that a vulnerability-management queue sorted by CVSS puts a 4.3 near the bottom on the same day it is being used for remote code execution. Severity is a property of one bug; exploitability is a property of a path. The only honest way to know whether the four links compose into working RCE on your specific build and configuration is to run the chain the way the attacker does.

That is the work an autonomous AI red team does continuously. Zero Hunt's 10-agent swarm fingerprints the exact Plex version and platform, then its generative engine writes an exploit chain for that environment — stitching the SSRF primitive to the loopback pivot, the token leak, and the file write — rather than replaying a static script. Its Exploit Forge iterates a runnable proof-of-concept until it demonstrably works, so the finding you receive is "this reaches code execution on your server," not "you have a medium SSRF somewhere." Every step runs on-premise on Zero Hunt's own private models — no customer data leaves the appliance, no third party can throttle or switch off the capability — with a human in the loop gating each exploitation action, and every verdict signed at write time (Ed25519, hash-chained) for the audit trail. The default campaign is black-box: the engine earns the result with no credentials, exactly as the internet does.

Once the chain is proven, the question becomes what do I do now — and for a patch-plus-assume-compromised event like this one, sequencing matters. The AI Remediation Advisor ranks findings by real exploitability (CISA KEV first, then what was proven reachable in the campaign, then CVSS and EPSS), hands you the exact fixed version with rollout and rollback notes and a compensating control for the servers you cannot patch tonight, and re-verifies the fix with the same proof that demonstrated the issue — so "patched" means re-tested, not just a higher version string. For the deadline itself, the penetration-testing-by-regulation guide maps where that evidence has to land.