Plex in the KEV catalog: home software, work access

On October 20, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, four of them in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The day before, Plex wrote that these flaws are "being actively and widely exploited." Plex is not enterprise software. That is exactly the question: what is your remote access worth when it starts from a machine that also runs a personal media server?

What the sources say

CISA. The October 20, 2026 alert lists the four Plex flaws, alongside one in EG Secure Solutions SiteGuard and one in Siemens Software Center. In the catalog's JSON file, two of the Plex flaws (CVE-2026-96654 and CVE-2026-96656) carry an October 23 due date, the other two November 3. For each, the catalog states that it can be chained with the other three, and the ransomware use field reads "Unknown."

Plex. The vendor released Plex Media Server 1.43.3 and announced it on September 1, 2026, recommending that all server owners update as soon as possible. On October 19, it added the details: chained together, the four flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. A public proof of concept came out on October 16, followed by widespread attacks against internet-facing servers that had not been updated. Plex writes that compromised servers were used to run cryptocurrency miners and proxy software, which routes other people's traffic through the victim's internet connection. Versions 1.43.3.10861 and later are not affected, and the instruction is clear: "If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised." Plex also asks owners to treat anything the service account could reach as exposed, "such as mounted shares and credentials stored on the same machine or VM," to turn off remote access if it is not needed and to avoid forwarding port 32400 directly.

LastPass, a precedent. In its March 1, 2023 update on the 2022 incident, LastPass writes: "The threat actor targeted a senior DevOps engineer by exploiting vulnerable third-party software." The attacker used it to deliver malware, bypass existing controls and reach cloud backups, which held among other things system configuration data, API secrets and integration secrets. LastPass says it reviewed and changed its privileged access controls and rotated the secrets and certificates that were accessed.

Why it matters

The company's real perimeter runs through employees' living rooms. A personal computer also used for remote work, a NAS on the same home network, a work laptop plugged into it: the security of remote access depends in part on software the IT team has never seen.

Plex's advisory makes the link concrete. What the service account reaches, shares and credentials stored on the same machine, is to be treated as exposed. If an employee opened a VPN session there, or saved a password or a token, that access is in the lot.

The LastPass case shows the leverage. A single vulnerable third-party software package on the machine of an engineer with privileged access led to the company's backups. The more rights a user has, the more their device deserves to be treated as a critical asset.

Finally, the proxy use described by Plex weakens trust based on IP address. If a compromised server routes other people's traffic, an employee's home address no longer proves that the employee is the one connecting.

What we think at Sentrix

1. Require device posture for all remote access. Operating system version, encryption, active detection agent, current patches: conditional access checks them before opening the session. Our endpoint and server security service sets them up and monitors them.
2. Separate personal and work for privileged access. Administration, production and secrets go only through a managed device, never through the family computer. That is the core of our identity and access service.
3. Do not trust a residential IP address. An allow list of addresses does not replace phishing-resistant multifactor authentication or a device check.
4. Inventory the software on managed devices, consumer software included. A Plex server on a work laptop shows up when you read the software inventory, then gets compared with the KEV catalog. That is what the CTEM continuous exposure module does.
5. Give a simple rule for the home network. Update software that exposes a service, turn off unneeded remote access, avoid port forwarding, isolate personal devices from the work computer when the router allows it.
6. Reduce what a device holds. Short sessions, time-limited tokens and rotated secrets limit what an attacker gets from a compromised machine, as LastPass did after the fact.

The next step

Ask three questions this week: who reaches your systems from a personal device, what posture is checked before the session opens, and which privileged accounts sign in from outside a managed device. If you want to answer them with us, contact us.