A patch queue sorted by CVSS would put the Plex Media Server issues near the bottom. Two of the four score 4.3, one scores 6.5 and the highest reaches 7.2. CISA added all four to its exploited catalog within a month of publication. The scores describe parts, not the assembled attack.

What each number measures

The scores come from a secondary CVSS source in the NVD records, all published 2026-09-23.

CVE-2026-96652, the unauthenticated SSRF in the player timeline, is 4.3 on CVSS 3.1. CVE-2026-96655, which lets an authenticated user request arbitrary addresses through the transcode path parameter, is also 4.3. CVE-2026-96654, the URL handling flaw in searchOne, is 6.5 with a network vector, low complexity and no privileges required. CVE-2026-96656, the arbitrary file write through transcoder preferences, is 7.2 and is the only one requiring admin rights.

CVSS 4.0 for CVE-2026-96654 reads 6.9 with the same attack characteristics. The differences between the two versions do not change the ranking.

Where the arithmetic breaks

A base score assumes one vulnerability and one exploit. This chain uses each flaw as a step: a request primitive that ignores token validity, an internal call surface reachable over loopback, a token disclosure, and a loader that runs unsigned shared objects at startup.

The final step is the only one that needs elevated rights. The preceding three obtain exactly that. Plex states the outcome without qualification: chained together, the issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.

Nothing in the CVSS base metrics models a precondition met by another CVE in the same advisory, which is why the assembled result exceeds every individual number.

The decision data that already disagrees with the scores

CISA added the four identifiers to the Known Exploited Vulnerabilities catalog on 2026-10-20. That entry carries more operational weight than a base score, because it records observed exploitation.

The catalog entry also splits the deadlines. CVE-2026-96656 and CVE-2026-96654 are due 2026-10-23, CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. CVE-2026-96656 carries a forensic triage requirement as well.

Plex's own analysis adds context the score cannot: a public proof of concept on 2026-10-16, widespread attacks on unpatched internet-facing servers, cryptocurrency mining and proxy software on compromised hosts, and instructions to assume compromise on any exposed server below 1.43.3.10861.

What a defensible prioritisation looks like

Treat the advisory as one unit rather than four tickets. Splitting the CVEs across a backlog produces exactly the failure mode that base scoring encourages: the 4.3 SSRF waits while the 7.2 file write is patched first, even though the write cannot be reached without the SSRF and the token disclosure.

Then check the exploitability precondition that matters in your environment. A Plex server with remote access disabled and no untrusted users is a different risk from one published on port 32400 with several managed accounts. The scores are equal in both cases; the exposure is not.

Finally, verify the loader state. A server already carrying an unfamiliar .so file in its Codecs folder is compromised regardless of which score authorised the patch window.

Where the chain stops being theoretical

Exploitation is reported by the vendor, not inferred by a researcher. That changes what evidence to collect: process names such as myawesomeproxy, mylovelyminer and x12345, new shared objects in the Codecs directory, connections to proxystream.st, and CPU load with nothing playing. Plex recommends rebuilding from a clean installation instead of reusing the data directory.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared, and vul.cve="CVE-2026-96654" returned 0. The product count describes reachable installations, not vulnerable instances, and it cannot distinguish a patched 1.43.3.10861 host from an older build.

References

  • CVE-2026-96652 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96652

  • CVE-2026-96654 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96654

  • CVE-2026-96655 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96655

  • CVE-2026-96656 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96656

  • Plex security notice: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

  • CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654