Four flaws in Plex Media Server chain into unauthenticated remote code execution, and the set is now in CISA's Known Exploited Vulnerabilities catalog. Plex patched all four in August, so every victim is a server that was never updated.

What happened

The chain starts with an SSRF in /player/timeline (CVE-2026-96652), moves through an input-handling bug in searchOne that yields the server owner's admin token (CVE-2026-96654, CVSS 6.9), uses a second SSRF on the transcode path (CVE-2026-96655, 5.3), and ends in an arbitrary file write into the Codecs directory that executes when the server loads it (CVE-2026-96656, CVSS 8.6).

Plex fixed all four in 1.43.3.10861 on 3 August 2026. CISA added them to the KEV catalog on 20 October, and Plex updated its own notice to say the flaws are being actively and widely exploited. A honeypot operator saw working attacks from 17 October, a day after exploit code was published, and captured an XMRig cryptominer and residential proxy software being installed.

Who is affected

• Any Plex Media Server older than 1.43.3.10861 that is reachable from the internet.
• Servers behind a port forward or UPnP-enabled router, which is how remote access is normally set up.
• NAS and home-server installs that were configured once and never touched again.

Version 1.43.3.10861 and later is not affected.

What to do now

If a server older than 1.43.3.10861 was internet-reachable, treat it as compromised, not merely out of date.

• Update to 1.43.3.10861 or later, then remove the port forward and disable remote access you do not need.
• Look for processes named myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in the Codecs folder, and outbound connections to proxystream.st.
• Rebuild rather than clean if anything matches. These payloads are built to persist.
• Rotate every credential stored or typed on that host, including the Plex account and any shared NAS logins.

What this means for South African businesses

The payload matters more than the media library. A residential proxy running on an office or home network gives an attacker a trusted outbound IP behind the firewall, which is a usable foothold for reaching business VPNs and mail rather than a piracy problem.

The practical question for an SME is whether staff run Plex on the same LAN as company machines and file shares. In most small businesses I would expect that answer to be yes, and I would treat an unpatched, internet-facing Plex box as a business risk, not a hobby.

Source: Plex Media Server security notice, with KEV status from CISA.

Also on the blog

• MikroTik RouterOS CVE-2026-88464: SNMP crash on 7.20 and later
• PHP CVE-2026-109618 and CVE-2026-109619: 9.2 RCE, patch due 14:00 UTC

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.