CyberSIXT Search
Vendor

Plex

2 CISA KEV deadlines are open. The nearest: CVE-2026-96652 in Media Server, due Tue 3 Nov. Coverage is above its usual rate: 8 articles in 7 days, against a weekly average of 0.3.

Tracked since 4 Sep · latest article Mon 26 Oct · RSS

Open KEV deadlines
2
nearest 3 Nov
High exploit odds · current
0
high · not in KEV
Articles · 7 days
8
↑ vs 0.3 a week

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline
CVE-2026-96652Media Server20 OctDue 3 NovRansomware: Unknown · 5 articles
CVE-2026-96655Media Server20 OctDue 3 NovRansomware: Unknown · 5 articles

Deadlines passed

CVE-2026-96654Media Server20 OctDeadline passed 23 OctRansomware: Unknown · 6 articles
CVE-2026-96656Media Server20 OctDeadline passed 23 OctRansomware: Unknown · 6 articles
CVE-2020-5741not in CyberSIXT coverageMedia Server10 Mar 2023Deadline passed 31 Mar 2023Ransomware: Unknown · 0 articles

Products

1 products · 5 CVEs in coverage
Media Server5 CVEs · 5 in KEVlatest 26 Oct

Coverage

10 articles · all timeFull timeline →

8 articles in the last 7 days. The weekly average over the 8 weeks before was 0.3.

10 articles from 5 outlets since 4 Sep; 5 in the last 7 days.

Plex: coverage over time10 articles from 5 outlets. First report 4 Sep by The Hacker News. Busiest day: 4 articles, 20 Oct. 5 in the last 7 days. Plex: coverage over time10 articles from 5 outlets. First report 4 Sep by The Hacker News. Busiest day: 4 articles, 20 Oct. 5 in the last 7 days.
  • Article
  • First report
  • Official notice
Show as table
Plex: articles
Published (UTC)OutletHeadline
Mon 26 Oct · 03:20 UTCSecurityOnlineWeekly report flags PHP and FortiSIEM flaws under attack
Tue 20 Oct · 20:31 UTCCISACISA Flags Actively Exploited Plex Server SSRF Flaw
Tue 20 Oct · 20:31 UTCCISACISA Flags Actively Exploited Plex Media Server Flaw for Patching
Tue 20 Oct · 20:31 UTCCISACISA Flags Exploited Plex Flaw That Can Reach Internal Systems
Tue 20 Oct · 20:31 UTCCISACISA Confirms Active Exploitation of Plex Media Server Flaw
Mon 19 Oct · 19:54 UTCSecurity AffairsAttackers exploit Plex2Shell flaws to hijack servers for mining and proxying
Mon 19 Oct · 19:18 UTCThe Hacker NewsHackers exploit Plex flaws to install crypto miners and Linux backdoors
Mon 19 Oct · 12:49 UTCSecurityWeekAttackers Exploit Plex2Shell Flaws to Install Miners and Proxy Software
Mon 19 Oct · 01:44 UTCSecurityOnlineAttackers Exploit Plex Flaws to Run Cryptominers and Proxy Tools
Fri 4 Sep · 08:41 UTCThe Hacker NewsPlex Patches Undisclosed Flaws in Media Server and Desktop Apps

Who reported 5 outlets, last 12 months

  • CISA4
  • The Hacker News2
  • SecurityOnline2
  • Security Affairs1
  • SecurityWeek1
See the full timeline
  1. Weekly report flags PHP and FortiSIEM flaws under attackSecurityOnline
  2. CISA Flags Actively Exploited Plex Server SSRF FlawCISA · official notice
  3. CISA Flags Actively Exploited Plex Media Server Flaw for PatchingCISA · official notice
  4. CISA Flags Exploited Plex Flaw That Can Reach Internal SystemsCISA · official notice
  5. CISA Confirms Active Exploitation of Plex Media Server FlawCISA · official notice
  6. Attackers exploit Plex2Shell flaws to hijack servers for mining and proxyingSecurity Affairs
  7. Hackers exploit Plex flaws to install crypto miners and Linux backdoorsThe Hacker News
  8. Attackers Exploit Plex2Shell Flaws to Install Miners and Proxy SoftwareSecurityWeek
  9. Attackers Exploit Plex Flaws to Run Cryptominers and Proxy ToolsSecurityOnline
  10. Plex Patches Undisclosed Flaws in Media Server and Desktop AppsThe Hacker News

All CVEs in coverage

5
CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVSS6.9MediumExploited1.9%EPSS6articles
CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVSS5.3MediumExploited1.8%EPSS5articles
CVE-2026-96656Plex Media Server External Control of File Name or Path VulnerabilityCVSS8.6HighExploited1.8%EPSS6articles
CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVSS5.3MediumExploited0.5%EPSS5articles
CVE-2025-34158Plex Media Server vulnerabilityCVSS8.5High–Not in KEV0.6%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device