Two of the four Plex Media Server CVEs fixed in 1.43.3.10861 do the quiet work. CVE-2026-96654 opens internal agent functions to a request that came from outside. CVE-2026-96655 turns that into the server owner's administrative token. Neither scores above medium.

CVE-2026-96654: what searchOne does with a URL

The NVD record describes incorrect neutralization of URL values in searchOne, which allows an attacker to call other plugins' functions and supply their own parameters. Plex summarizes the impact as access to internal agent functions over the loopback interface.

Both descriptions point at the same design. Plex agents expose local HTTP surfaces that the server queries on behalf of clients. A parameter that selects the destination or the function is supposed to be constrained by the server. When it is not, a caller can address an agent function the client was never meant to reach and pass arguments of its own choosing.

The score is 6.5 on CVSS 3.1, with a network attack vector, low complexity and no privileges required. CISA lists it in the Known Exploited Vulnerabilities catalog from 2026-10-20, with a due date of 2026-10-23.

CVE-2026-96655: the token rather than the address

CVE-2026-96655 lives in /video/:/transcode/universal. NVD says the path parameter allows an authenticated user to request arbitrary internal or external addresses. Plex describes the outcome differently and more seriously: disclosure of the server owner's admin token.

That difference matters. An SSRF that returns a body tells you about internal services. An SSRF that returns an owner token gives you control of the server. The token authorises library changes, user management, remote access configuration and the transcoder preference that the fourth CVE needs.

Its score is 4.3 on CVSS 3.1. CISA lists it with a due date of 2026-11-03.

How the middle joins the ends

The chain only works as an order. CVE-2026-96652 provides an unauthenticated request primitive through /player/timeline, accepting any X-Plex-Token value. That primitive lets the attacker reach the agent surface that CVE-2026-96654 exposes, which in turn reaches the transcode path parameter that CVE-2026-96655 leaks a token from. With the owner token in hand, CVE-2026-96656 writes to the Codecs directory, and the service runs the result at its next start.

Plex states the assembled outcome plainly: chained together, the four issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. The vulnerability was already being exploited when the vendor updated the advisory.

Why these two are the hardest to detect

The first and last steps leave obvious traces. An external request to /player/timeline stands out in a web server log, and a new shared object in the Codecs folder stands out in a file listing.

The middle steps look like normal Plex behaviour. The server itself queries its agents over loopback all day. Transcode requests are routine. A log that records the request but not the parameters of an internal agent call will not show the difference between a legitimate plugin lookup and an attacker-directed one.

That is the practical reason to look at consequences rather than at individual requests: unfamiliar shared objects, unexplained child processes such as myawesomeproxy, mylovelyminer or x12345, outbound connections to proxystream.st, and sustained CPU use while nothing is playing.

Containment between the halves

Disabling remote access under Settings, then Remote Access, removes the internet path for the first CVE. Avoiding direct forwarding of port 32400 has the same effect. Neither step closes the flaws, and Plex does not present them as fixes.

A reverse proxy that authenticates every request before forwarding to Plex narrows the population that can reach /player/timeline, which interrupts the first link. It does not help if the attacker already holds a token.

Rotating the owner token is the control that addresses CVE-2026-96655 after exposure. In Plex that means signing out all devices and changing the account password, which the vendor recommends as part of remediation for a suspect server.

The version check that ends the discussion

Open Plex Web, go to Settings, then General, and read the version. 1.43.3.10861 and later contain the fixes. Below that, the middle of the chain is reachable to the extent that the first step is.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared, and vul.cve="CVE-2026-96654" returned 0. The product count measures internet-facing installations, not hosts with exposed agent surfaces or leaked tokens.

References

  • CVE-2026-96654 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96654

  • CVE-2026-96655 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96655

  • Plex security notice: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

  • CVE-2026-96652 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96652

  • CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655