Plex vulnerabilities

10 published CVEs name Plex among the affected products; CISA lists 4 of them as exploited in the wild.

Critical 0High 5Medium 5Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-96656
Plex Media Server arbitrary file write
Plex · Media Server
ExploitedHigh8.6
CVE-2026-96655
Plex Media Server arbitrary-host SSRF
Plex · Media Server
ExploitedMedium5.3
CVE-2026-96654
Plex Media Server URL injection
Plex · Media Server
ExploitedMedium6.9
CVE-2026-96652
Plex Media Server SSRF
Plex · Media Server
ExploitedMedium5.3

CVE-2026-96656
Plex Media Server arbitrary file write
Plex · Media Server
ExploitedHigh8.6
CVE-2026-96655
Plex Media Server arbitrary-host SSRF
Plex · Media Server
ExploitedMedium5.3
CVE-2026-96654
Plex Media Server URL injection
Plex · Media Server
ExploitedMedium6.9
CVE-2026-96652
Plex Media Server SSRF
Plex · Media Server
ExploitedMedium5.3
CVE-2026-96651
Plex Media Server path traversal
Plex · Media Server
High7.1
CVE-2025-69417
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via…
Plex · plex.tv backend
Medium5.0
CVE-2025-69416
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via…
Plex · plex.tv backend
Medium5.0
CVE-2025-69415
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is…
Plex · Media Server
High7.1
CVE-2025-69414
Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.
Plex · Media Server
High8.5
CVE-2025-34158
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the…
Plex · Media Server
High8.5