FRDE Sign in Free trial
Background exploitation KEV catalog
CVE-2020-5741

Plex Media Server Remote Code Execution Vulnerability

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

CheckOps priority index
6.9/10 Patch within 7 days
Severity7.2
Probability7.3
Exploitation3/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 72.9% +0.2 pts in 7 days
CVSS 3.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:
Exploited for 1,334 days 10 Mar 2023
CISA due date 31 Mar 2023 for US federal agencies

Exploitation probability EPSS · FIRST

05010026 Sep05 Oct15 Oct24 Oct02 Nov
EPSS probability (%)Percentile among all CVEs

Exploitation signals 3 / 5

  • KEV catalog (CISA)10 Mar 2023
  • Exploited in EUVD (ENISA)10 Mar 2023
  • Used by ransomwareno
  • EPSS above 10 %72.9%
  • No account, over the networkno

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply updates per vendor instructions.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Affected products

Plex Media Server (Windows)Media Server
Affected versions
  • Versions prior to 1.19.3
Weaknesses (CWE)
CWE-502

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

  1. Published

  2. Exploitation reported (ENISA)

  3. Added to the KEV catalog

  4. CISA remediation due date

  5. EPSS peak: 72.9%

References

Other exploited vulnerabilities from the same vendor

  • CVE-2026-96656Plex Media Server External Control of File Name or Path Vulnerability
    4.7 · Rising fast
  • CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
    3.4 · Rising fast
  • CVE-2026-96654Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
    4.6 · Rising fast
  • CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
    3.4 · Rising fast

Are you affected?

CheckOps reads your SBOMs and scans, and alerts you as soon as one of your dependencies is exploited.

Get notified at launch

Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors. All exploited vulnerabilities