CVE-2020-5741: Plex Media Server Windows deserialization leads to Python code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.2 with KEV listing, public exploit references and very high EPSS, though exploitation requires authenticated access.

What it is

Plex Media Server on Windows deserializes untrusted data, allowing a remote, authenticated attacker to execute arbitrary Python code. The flaw is a CWE-502 deserialization issue rated CVSS 3.1 7.2 (HIGH). It matters because a media server is often internet-exposed and holds credentials and library data.

Impact

An attacker with valid credentials gains arbitrary Python code execution in the context of the Plex Media Server process, leading to full compromise of the host and its data.

Attack surface

Reached over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but it requires high privileges (PR:H), meaning the attacker must already hold an authenticated account on the server.

Exploitation

CVE-2020-5741 is listed in CISA KEV (added 2023-03-10) and has an EPSS 30-day probability of 0.72936 (99.4th percentile), and references carry Exploit tags, indicating public exploit code exists. No ransomware campaign use is documented.

What to do

• Apply the vendor update for Plex Media Server on Windows per Plex instructions; this is the required KEV action.
• Restrict network exposure of the Plex Media Server management and API interfaces to trusted networks or a VPN.
• Audit and minimize Plex accounts with server access, and enforce strong unique credentials and MFA where supported.
• Monitor for unexpected Python processes or child processes spawned by the Plex Media Server service.

Detection

• Alert on Plex Media Server spawning python.exe or other unexpected child processes.
• Monitor Plex server logs for anomalous authenticated API requests or deserialization-related errors.
• Hunt for new files or scripts written to Plex data, plugin, or temp directories.
• Review network flows to Plex management ports from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.