Plex vulnerabilities and fixes

CVEs that mention Plex, ranked by priority. 4 tracked.

Plex has 4 tracked vulnerabilities, 0 critical and 4 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 4. Most recent: 2026-09-23. Highest priority: CVE-2026-96656 (score 64/100).

• CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-96652 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96655 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

FAQ

How do I fix Plex vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Plex being exploited right now?

Yes: 4 Plex CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Plex CVE should I patch first?

CVE-2026-96656 currently ranks highest (64/100): Plex Media Server External Control of File Name or Path Vulnerability.

← Back to latest CVEs