21 October 2026
Reference: CVE-2026-96652
1. What is being reported?
The Plex Media Server software has a flaw that lets an attacker use a special part of the system to make the server send data to a destination chosen by the attacker. This happens through a feature called 'protocol' in the server’s timeline function, and it can be done by anyone who can provide any Plex access token.
2. What this means in plain English
If your organisation uses Plex Media Server, an attacker could potentially use this flaw to make your server communicate with harmful or unintended locations. This could lead to data leaks or allow further attacks on your network or connected systems.
3. Could this affect a small business?
Small businesses or organisations using Plex Media Server versions before 1.43.3.10861 could be affected, especially if the server is accessible from the internet. If you do not use Plex Media Server, or it is not exposed online, this vulnerability likely does not affect you.
4. What to do now
- Check if you are using Plex Media Server and identify the version installed.
- If using a vulnerable version, update Plex Media Server to version 1.43.3.10861 or later as soon as possible.
- If an update is not immediately possible, follow any mitigation steps recommended by Plex or your IT provider to reduce exposure.
- Ensure your Plex server is not unnecessarily accessible from the internet and restrict access where possible.
5. Ask your IT provider
Can you confirm if our Plex Media Server is affected by CVE-2026-96652 and ensure it is updated or properly mitigated to prevent exploitation?
6. Bottom line
If you use Plex Media Server, update it promptly to protect your organisation from an actively exploited security flaw.
Information based on CISA KEV, NVD, and reputable security news reports.