Plex known exploited vulnerabilities
CISA lists 5 Plex CVEs as exploited in the wild. 4 were added in the last 12 months (latest 2026-10-20), and 0 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2020-5741 (Media Server): EPSS 72.8%, added 2023-03-10
- CVE-2026-96656 (Media Server): EPSS 0.8%, added 2026-10-20
- CVE-2026-96654 (Media Server): EPSS 0.4%, added 2026-10-20
- CVE-2026-96655 (Media Server): EPSS 0.4%, added 2026-10-20
- CVE-2026-96652 (Media Server): EPSS 0.4%, added 2026-10-20
Most affected Plex products
Media Server (5).
All Plex CVEs in KEV
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2026-96656 | Media Server | Media Server External Control of File Name or Path | 2026-10-20 | 2026-10-23 | 0.8% | – |
| CVE-2026-96655 | Media Server | Media Server Server-Side Request Forgery (SSRF) | 2026-10-20 | 2026-11-03 | 0.4% | – |
| CVE-2026-96654 | Media Server | Media Server Improper Neutralization of Encoded URI Schemes in a Web Page | 2026-10-20 | 2026-10-23 | 0.4% | – |
| CVE-2026-96652 | Media Server | Media Server Server-Side Request Forgery (SSRF) | 2026-10-20 | 2026-11-03 | 0.4% | – |
| CVE-2020-5741 | Media Server | Media Server Remote Code Execution | 2023-03-10 | 2023-03-31 | 72.8% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · Rank your own CVE list (KEV + EPSS) · Which vulnerable dependency to fix first · All vendors