Plex Media Server RCE chain of four CVEs lands in CISA KEV catalog

Plex patched four vulnerabilities in Plex Media Server 1.43.3 that chain into unauthenticated remote code execution. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on 20 October, and Plex advises owners of older exposed servers to assume compromise.

• CVE-2026-96652, 96654, 96655 and 96656 affect builds before 1.43.3.10861
• A public proof of concept appeared on 16 October, four days before the KEV entry
• Attackers deployed miners and proxies such as mylovelyminer and proxystream.st
• Remediation deadlines are 23 October for two CVEs and 3 November for the others