Plex Media Server flaws are being actively exploited
Four Plex Media Server flaws were added to the US list of known exploited vulnerabilities. Common on office NAS boxes.
What happened
CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalog after attacks in the wild.
Am I affected?
- You run Plex Media Server, often installed on a NAS
- It is reachable from the internet
What our daily plans do
Business and Pro plans update Plex and check whether the NAS is exposed to the internet.
What you can do yourself
- Update Plex Media Server
- Turn off remote access if you do not need it
- Make sure the NAS is not directly exposed to the internet