Plex Media Server Vulnerability CVE-2026-96652: KEV Chain Exploited, What NYC SMBs Should Do

Plex is the app people use to stream their own movies, music, and photos. It usually lives at home, on a gaming PC or a network storage box in a closet. So why is a Plex Media Server vulnerability showing up on a New York City business IT blog? On Tuesday, October 20, CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Two of them carry a federal remediation due date of today, Friday, October 23. The other two are due November 3.

Plex says these bugs are being “actively and widely exploited.” The machines that run Plex are often the same ones your staff use to work from home, or the same storage box that holds a copy of the office files. Below is what NYC business owners and office managers need to know, using only what Plex and CISA have published.

What happened, in plain terms

On September 1, Plex released Plex Media Server version 1.43.3 to fix several security issues and asked every server owner to update. On October 19, Plex updated that same forum notice with the CVE numbers and some bad news. A public proof of concept came out on October 16, and since then Plex has seen widespread attacks against internet-facing servers that were never updated.

Plex describes the four issues this way:

• CVE-2026-96652: unauthenticated server-side request forgery (SSRF) in the player timeline endpoint. Put simply, an outsider can make your Plex server send web requests on their behalf.
• CVE-2026-96654: access to internal agent functions over the loopback interface. These are parts of Plex that were only supposed to be reachable from the machine itself.
• CVE-2026-96655: disclosure of the server owner’s admin token, which works like a master key to that Plex server.
• CVE-2026-96656: arbitrary file write to the Codecs folder through transcoder preferences. That lets someone drop files that Plex will later load and run.

Any one of these is a problem. Chained together, Plex says, they “let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.” CISA’s KEV entries also note that the four can be chained. Plex Media Server 1.43.3.10861 and later are not affected.

We won’t go into how the chain works. That isn’t useful to a business owner, and it helps the wrong people. What matters is that attackers no longer need a password. They only need to find an unpatched server that’s reachable from the internet.

What attackers are doing with compromised Plex servers

According to Plex, compromised servers have been used for two things so far:

• Cryptocurrency miners, which burn your electricity and processor time to make money for someone else.
• Proxy software, which routes other people’s internet traffic through the victim’s connection.

The second one deserves more attention than it gets. If a criminal’s traffic leaves through your internet connection, the activity traces back to your IP address. That can get your office or home connection flagged, blocklisted, or tied up in someone else’s abuse report.

Plex also warns that the damage may not stay inside Plex. Its guidance says to “treat anything the Plex service account could reach as potentially exposed, such as mounted shares and credentials stored on the same machine or VM.” Mining and proxying are what Plex has seen so far. Once someone can run code on a machine, they’re not limited to those two things.

Why a home media app is a business risk for NYC SMBs

Most of the small businesses we support across New York City don’t run Plex on purpose. That’s exactly why it slips through. Here are the three places we usually find it:

1. The network storage box in the office

Many NAS devices from Synology, QNAP, Western Digital, Netgear, and TerraMaster offer Plex as a one-click app. An office manager, a tech-savvy partner, or a previous IT person installs it so the conference room TV can play training videos or so someone can stream music. Now a media server is running on the same box that holds client files, scans, and backups. Plex notes that NAS package managers may lag behind its own releases, so a NAS that says it’s “up to date” can still be running a vulnerable Plex build.

2. Remote workers’ home networks

Hybrid work is normal now in Manhattan, Brooklyn, Queens, and Staten Island. A lot of people working from home share a network with a family Plex server, and some run Plex on the same PC they use for work. If that server gets compromised, the attacker is on the same network as the laptop that connects to your Microsoft 365, your line-of-business apps, and maybe your VPN. Credentials saved on that machine are, in Plex’s own words, potentially exposed.

3. “Temporary” port forwards that never went away

Plex listens on port 32400. To reach it from outside the house or office, people often forward that port on the router. Plex’s guidance is direct: if you don’t need remote access, turn it off, and avoid forwarding port 32400 directly unless you need it.

What to do this week

Here’s a checklist based on Plex’s published guidance and CISA’s KEV entry. Owners and office managers can work through most of it with their IT provider in under an hour.

Step 1: Find out whether Plex is running anywhere you own

Check office NAS devices, spare PCs, media PCs attached to conference room TVs, and any server or virtual machine someone set up “just to try something.” Ask staff who work from home whether they or anyone in their household runs a Plex server on the same network, and especially on the same computer they use for work.

Step 2: Update to 1.43.3.10861 or newer

Plex says to open Plex Web, go to Settings → General, and check the version. Anything older than 1.43.3.10861 needs updating. Plex’s notice links to update steps for Windows, macOS, Linux, Docker, NVIDIA Shield, and the major NAS brands. If your NAS app store hasn’t caught up, Plex says you can install the package manually from its Downloads page.

Step 3: If it was exposed and out of date, assume compromise

This is the part people skip. Plex says plainly that if your server was older than 1.43.3.10861 and reachable from the internet, you should “assume it may be compromised.” Updating closes the door. It doesn’t remove anyone who already got in. Plex lists these warning signs:

• Processes started by Plex Media Server that you don’t recognize. Plex specifically names myawesomeproxy, mylovelyminer, and x12345.
• Unfamiliar .so or .dll files in the Plex Codecs folder.
• Outbound connections to proxystream.st.
• Sustained high CPU use while nothing is playing.

Step 4: Clean up properly if anything looks off

If you find any of those signs, or you can’t rule out compromise, Plex recommends rebuilding the server from a clean installation instead of reusing the old Plex data directory. At minimum, it says to delete everything in the Codecs folder and check Preferences.xml for transcoder options you didn’t set. Then sign out of all devices from the Plex account settings and change the Plex password.

For a business, we’d go a step further. If that machine had office shares mounted or work passwords saved in a browser, reset those passwords too, and review sign-in activity for the accounts involved. Plex’s guidance to treat everything the service could reach as exposed is the right way to think about it.

Step 5: Turn off remote access you don’t need

If nobody actually streams from outside the building, disable remote access under Settings → Remote Access and remove any router rule forwarding port 32400. While you’re in the router, look at every other port forward and ask what it’s for. If nobody can answer, that’s worth fixing.

Step 6: Decide whether Plex belongs on business equipment at all

For most offices, the honest answer is no. A file server or NAS that holds client data shouldn’t also be a public-facing media server. If the business really needs internal video, there are safer ways to set that up. The fewer consumer apps running on business storage, the fewer emergency patches you’ll be chasing.

Questions to ask your IT provider

If you already work with an IT company or MSP, these four questions will tell you a lot about how they handle a KEV like this:

“Do we have Plex, or any other consumer media or remote-access app, running on any office NAS, PC, server, or VM?”

“If so, what version is it, and was it reachable from the internet before it was updated?”

“Did you check for the warning signs Plex published, like unknown processes, odd files in the Codecs folder, or traffic to proxystream.st?”

“What’s our policy for staff who work from home on networks that run servers like this?”

A good provider can answer quickly and in writing. If nobody knows what’s running on your NAS or which ports are open on your router, that’s a finding in itself.

The bigger lesson: shadow IT shows up on the KEV list too

Most KEV entries we write about are business products like firewalls, VPNs, email gateways, and remote support tools. We covered BeyondTrust Remote Support CVE-2026-102764 on Monday and Windows Shell CVE-2026-96951 last week. Plex is a reminder that attackers don’t care whether software was bought by the business or installed by an employee on a Saturday. Anything on your network that faces the internet is part of your attack surface.

How MicroSky helps when a KEV lands

When CISA adds a new entry to the KEV catalog, MicroSky Managed Services follows the same routine for every client. We check our asset inventory and endpoint data to see who runs the affected software, including apps nobody told us about. We confirm the vendor’s fixed version and apply it or verify it. We check exposed systems for the warning signs the vendor published. Then we close unneeded ports and remote access, and we document what we found and what we changed.

If you aren’t sure whether Plex, or any other consumer app, is running on your office network or your team’s home setups, we can help you find out and clean it up. Call MicroSky at (718) 672-2177 or visit microskyms.com to talk with our team.

Sources: Plex, “Important Security Update for Plex Media Server v1.43.2 and earlier” (posted September 1, 2026; updated October 19, 2026 with CVE details and active exploitation); CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.21; entries added October 20, 2026); NIST NVD entries for CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Research compiled by MicroSky as an in-house SA-research pack.