Plex is Being Actively Exploited Right Now. Is Your Media Server a Backdoor Into Your Business?
Four vulnerabilities in Plex Media Server landed on the CISA Known Exploited Vulnerabilities catalogue on the 20th of October 2026. Not flagged as theoretical. Not marked as “under investigation”. Confirmed active exploitation.
The patches have been available since September 2026. Tens of thousands of servers are still running unpatched versions.
This is the gap that gets businesses breached.
What Plex Is, and Why It Is on Your Network
Plex is software for hosting and streaming your own media: films, music, photos. It runs on a server, and you access it from your devices. Plex claims more than 25 million users globally.
That number matters because Plex is not an abstract enterprise system. It is the kind of software a director installs on the office server over a weekend, or that an employee runs on a machine that also connects to business systems. It is personal software that quietly becomes business infrastructure.
Plex Media Server listens for connections. That means it needs network access, and in many installations it has ports open to the internet. That exposure is precisely what makes these vulnerabilities operationally dangerous.
The Four Vulnerabilities, and Why They Chain
CISA added four Plex vulnerabilities to the KEV catalogue on the 20th of October 2026. They are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The catalogue entry for each notes explicitly that they can be chained together.
CVE-2026-96652 is a server-side request forgery (SSRF) vulnerability. SSRF means an attacker can force your server to make HTTP requests to destinations of the attacker’s choosing. The exploit requires only a valid Plex token, not full administrative access. The attacker supplies a URL in the protocol parameter, and your Plex server obediently POSTs to wherever they point it. That destination can be an internal system on your network, or an attacker-controlled server receiving your data.
CVE-2026-96655 is a second SSRF variant, this time via the video transcoding path. An authenticated user can supply an arbitrary URL through the /video/:/transcode/universal path parameter, causing the server to request internal or external addresses.
CVE-2026-96654 involves improper neutralisation of encoded URI schemes. An attacker can call other Plex plugin functions and supply their own parameters, expanding the attack surface considerably by weaponising Plex’s own internal components.
CVE-2026-96656 is the most directly damaging of the four. It is a file write vulnerability: an admin-level user can write arbitrary files to locations that execute when the server loads. Chain this with the SSRF vulnerabilities to gain an administrative position first, then write the file, then trigger execution. The result is remote code execution on the machine running Plex.
The chain is not hypothetical. Active exploitation is confirmed. Proof-of-concept exploit code is publicly available.
ClickFix Is in the Picture Too
Separately, but on the same day, CISA also added CVE-2026-110936 to the KEV catalogue. This is a vulnerability in Siemens Software Center, a tool used to download, install, and activate Siemens software products.
The vulnerability is a DLL sideloading flaw. An attacker places a malicious DLL file in a directory that Siemens Software Center searches at startup. When the application launches, it finds and loads the malicious file, executing arbitrary code with the privileges of the application.
This vulnerability has been actively exploited in ClickFix attacks. ClickFix is a social engineering technique where victims are manipulated into running malicious commands themselves, typically through fake error messages or browser prompts that instruct them to “fix” a problem by copying and running a provided command. In this case, the attack uses that initial access to place the malicious DLL, then waits for the Siemens software to launch.
The relevance for UK small businesses: if your operations involve Siemens industrial or engineering software, your team may have Siemens Software Center installed. The patch was issued on the 15th of October 2026. The question is whether it has been applied.
ClickFix attacks are also worth noting as a broader pattern. They do not require technical sophistication from the attacker. They require only that a member of your team follows an instruction they believe to be legitimate. That is a social engineering problem, not a technical one, and it persists regardless of what software you patch.
Autonomous AI Attacks: The Volume Problem
Also confirmed this week: attackers are using autonomous AI agents to attack company websites at scale. A Chinese-speaking criminal operation used AI agents to target over 1,200 sites with minimal human intervention, with confirmed successful breaches and leaked credentials captured from exposed operator panels.
The detail that warrants attention here is the scale and the reduced cost to the attacker. When attack operations require significant human effort, there is a natural ceiling on how many targets can be pursued simultaneously. Autonomous agents remove that ceiling.
For small businesses, this shifts the calculus. The assumption that attackers are selective, that they will focus on larger, more valuable targets, becomes less reliable when attack cost approaches zero per target. Unpatched software, weak credentials, and exposed services become more dangerous when the scanning and exploitation pipeline is largely automated.
This is not a reason for panic. It is a reason to close the obvious gaps: patch promptly, remove unnecessary internet-facing services, enforce multi-factor authentication. These measures remain effective against automated attacks precisely because they raise the cost of exploitation back above zero.
Why This Gives You an Edge
Businesses that treat patching as a routine operational task, rather than an emergency response to headlines, are in a substantially different position than those that do not.
If your Plex instance was updated in September 2026 when the patches were released, the active exploitation confirmed on the 20th of October 2026 is not your problem. It is someone else’s problem. That is the competitive position you want to be in.
The same applies to Siemens Software Center. If your team applied the patch issued on the 15th of October 2026, the ClickFix attacks exploiting that vulnerability cannot use your systems as an entry point.
Patch management is not glamorous. Vendors do not sell it as a differentiator. But when your peers are scrambling to respond to active exploitation, the business that patched on schedule is simply not in the conversation. That has real value: no incident response costs, no regulatory notification obligations, no customer trust damage.
If you hold Cyber Essentials certification, prompt patching of known vulnerabilities is a baseline requirement. Being able to demonstrate that your patch window is measured in days, not weeks or months, strengthens that certification and reduces the risk of a failed renewal audit.
Making the Business Case
If you need to make the case internally for taking this seriously, three arguments tend to land.
Active exploitation is confirmed, not theoretical. The CISA Known Exploited Vulnerabilities catalogue is not a prediction. It is an observation. These vulnerabilities are being used by real attackers against real systems right now. The question is not whether exploitation is occurring; it is whether your systems are among those targeted.
The attack surface is larger than it appears. Plex has 25 million users. Many of those are individuals who have installed it on machines connected to business networks. A single unpatched Plex instance on a machine that also accesses your shared drives, your email, or your accounting system is a potential lateral movement path. The attacker does not need to target your business directly; they need to find a connected system that is vulnerable.
The remediation cost is low. Updating Plex costs nothing and takes minutes. Responding to a breach costs considerably more. The NCSC estimates that the average cost of a cyber incident for a small UK business has risen substantially in recent years. An update applied this week is insurance against a fraction of that cost.
What to Do This Week
1. Find out whether Plex is running anywhere in your environment.
This is not just the office server. Ask staff whether they run Plex on any machine that connects to business systems or business networks. Personal devices used for work, home machines with VPN access, and office infrastructure should all be checked.
2. Update Plex Media Server immediately.
Patches were released by Plex in September 2026. If you are running Plex, open the application, navigate to settings, and check for updates. If you are not sure which version you are running, that is itself a problem: your patch status should be known, not guessed.
3. Check whether Plex ports are exposed to the internet.
Plex listens on port 32400 by default. If that port is open to the internet on your server or router, and your installation is unpatched, you are directly reachable by the attacks CISA has confirmed are under way. Check your router’s port forwarding rules and your firewall configuration. If you do not need remote access to Plex from outside your network, close the port.
4. Apply the Siemens Software Center patch if relevant.
If your business uses any Siemens software products, confirm that Siemens Software Center has been updated with the patch issued on the 15th of October 2026 (CVE-2026-110936). If your MSP manages your Siemens software, ask them to confirm in writing that the patch has been applied and the date on which it was done.
5. Brief your team on ClickFix as a technique.
The Siemens attack used ClickFix, but the technique is product-agnostic. If a member of your team sees an error message or browser prompt asking them to copy and run a command, that is a social engineering attack. Staff do not need to understand the technical details; they need to know the pattern and to know that the correct response is to stop and call IT or their MSP before doing anything.
Before you go: if you found this useful, follow the show wherever you listen, leave a rating or a review, and drop a comment with your thoughts. If you know someone running a small business who would benefit from this, share it with them. It costs nothing and it might matter a great deal.