Plex known exploited vulnerabilities
The Beam CVE database tracks 5 known exploited vulnerabilities for Plex: 2 high and 3 medium severity. The newest is CVE-2026-96652, published Sep 23, 2026.
These are the Plex vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 5
- Critical
- 0
- Known exploited (CISA KEV)
- 5
- Published in the last 30 days
- 4
All entries, newest first
CVE-2026-96652
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
medium4.3ExploitedSep 23, 2026CVE-2026-96654
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
medium6.5ExploitedSep 23, 2026CVE-2026-96655
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
medium4.3ExploitedSep 23, 2026CVE-2026-96656
Plex Media Server External Control of File Name or Path Vulnerability
high7.2ExploitedSep 23, 2026CVE-2020-5741
Plex Media Server Remote Code Execution Vulnerability
high7.2ExploitedMay 8, 2020
