For: anyone who runs Plex Media Server on a PC, NAS, home server, cloud server or in Docker, especially if it can be reached from the internet. This page is based on Plex's own security notice, NVD, CISA's advisory data and KEV catalog; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
- Who is affected
anyone who runs Plex Media Server on a PC, NAS, home server, cloud server or in Docker, especially if it can be reached from the internet.
- Confirmed so farSee the table ↓
- Affected and fixed versions
- Chained, no login needed
- Attacks against outdated servers
2 more
- What compromised servers were used for
- CISA KEV
- Not yet confirmed
- How many servers have been compromised
- Whether attackers did more than install miners and proxy software
- Whether every NAS vendor's app store now offers the fixed version
- What to do nowSee the steps ↓
- Check your server version
- Update to 1.43.3.10861 or later
- Reduce exposure
2 more
- If an older version was reachable from the internet, check for compromise
- Treat what the server could reach as exposed
- Where to verify (source)All sources ↓
- Plex, "Important Security Update for Plex Media Server v1.43.2 and earlier" (September 1, updated October 19 UTC)
- Last checked
- As of October 31, 2026 (JST)
Follow-up plans and what we checked
Plex's notice, the fixed release and the KEV entries are public. We checked Plex's forum posts, NVD, CISA's advisory data and the KEV feed (version 2026.10.30) on October 31.
What to do today
Check your server version
Open Plex Web, go to Settings, then General, and read the version shown. Plex says 1.43.3.10861 and later are not affected. Check every server you run, including old ones on a NAS or a spare PC.
Update to 1.43.3.10861 or later
On Windows and macOS, make sure automatic updates have actually installed the new version, or download it from Plex's Downloads page. On Linux, install the new .deb or .rpm package. For Docker, pull the current image as described in Plex's Docker repository. On a NAS, Plex says the vendor's app store may lag; download the package for your device from Plex and use the NAS's manual install option.
Reduce exposure
Plex advises turning off Remote Access (Settings, Remote Access) if you do not need it, and avoiding forwarding port 32400 directly unless you need it. Check your router for port forwarding or UPnP rules that point to the server.
If an older version was reachable from the internet, check for compromise
Plex says to assume such a server may be compromised. Its checks, in general terms: processes started by Plex Media Server that you do not recognise, unfamiliar files in the Plex Codecs folder, unexpected outbound connections, and sustained high CPU use while nothing is playing.
If you find any of these, or cannot rule out compromise, Plex recommends rebuilding the server from a clean installation rather than reusing the old Plex data folder. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options you did not set. Then sign out of all devices in your Plex account settings and change your Plex password.
Treat what the server could reach as exposed
Plex says to treat anything the Plex service account could reach as potentially exposed, such as mounted shares and credentials stored on the same machine or virtual machine. Change passwords stored there, and review the other devices on the same network.
What was disclosed
- Product
- Plex Media Server, software that serves your own video, music and photo library to Plex apps
- CVEs
- CVE-2026-96652 (server-side request forgery, SSRF), CVE-2026-96654 (URL values not neutralised), CVE-2026-96655 (SSRF; Plex describes it as disclosure of the owner's admin token), CVE-2026-96656 (arbitrary file write by an admin user)
- Combined effect
- Code execution with the privileges of the Plex Media Server process, without authentication, when chained (Plex)
- Severity
- Individually CVSS v3.1 4.3 to 7.2 (scores from CISA as the CVE numbering authority). The researcher rates the full chain 9.8; that is not an official score
- Affected
- Versions before 1.43.3.10861
- Fixed
- 1.43.3.10861 (released to everyone on August 4, 2026). Latest on October 31: 1.43.5.11079
- Exploitation
- "Actively and widely exploited" against internet-facing servers that have not been updated (Plex, October 19 UTC)
- KEV
- Added October 20. Due October 23 (CVE-2026-96654, -96656) and November 3 (CVE-2026-96652, -96655). CVE-2026-96656 is also marked for CISA's forensic triage requirements
CISA's advisory data for the same release also lists a fifth flaw, CVE-2026-96651 (path traversal, file read with a valid session token). It is fixed in the same version and is not in the KEV catalog.
1. Check the version
Settings, General: 1.43.3.10861 or later?
2. Update and close the port
Update; turn off Remote Access if unused
3. Check exposed servers
Plex's checks; rebuild if in doubt
Timeline
August 3-4, 2026
Plex Media Server 1.43.3.10861 is released to the beta channel (August 3) and then to everyone (August 4).September 1
Plex posts a security notice asking all server owners to update to 1.43.3 or newer, and says CVEs have been requested.September 23
The CVE records are published, with 1.43.3.10861 as the fixed version.October 16
The security researcher who found the chain publishes its details under the name Plex2Shell, and a public proof of concept appears (Plex).October 17
A security researcher reports seeing the chain exploited against a honeypot to install a cryptocurrency miner.October 19 (UTC)
Plex updates its notice with the CVE list and says the flaws are being actively and widely exploited.October 20
CISA adds all four CVEs to the KEV catalog.October 26
Plex Media Server 1.43.5.11079 is released to everyone.
What is known and not known
| Item | What the sources say | Status |
|---|---|---|
| Affected and fixed versions | Before 1.43.3.10861; fixed in 1.43.3.10861 | Confirmed |
| Chained, no login needed | Stated by Plex | Confirmed |
| Attacks against outdated servers | Actively and widely exploited (Plex) | Exploitation confirmed (Plex) |
| What compromised servers were used for | Cryptocurrency miners and proxy software (Plex) | Exploitation confirmed (Plex) |
| Number of compromised servers | Not published | Not stated |
| Theft of data or account credentials from servers | Not published | Not stated |
| CISA KEV | All four added October 20 | Confirmed |
Why the scores hid the risk
None of the four CVEs scores above 7.2 on its own. By their CVSS vectors, three of them need a login: CVE-2026-96652 and CVE-2026-96655 a low-privileged one, and CVE-2026-96656 admin rights. Plex says that chained together they need neither. A patch queue sorted by individual CVSS scores would have put them near the bottom, which is why the KEV listing matters more than the numbers here (see how to decide which CVEs to fix first).
The fix was also available for more than two months before the details were published. Servers that update automatically were already protected. Servers on a NAS whose app store lagged, or that were set up once and left alone, were not.
The researcher who found the chain writes that large language models were used heavily in finding and checking the flaws. Finding chains of small bugs in home software is getting cheaper, so the gap between a fix and an attack can shrink.
Sources
Checked on October 31, 2026 (JST).
- Plex, "Important Security Update for Plex Media Server v1.43.2 and earlier" (September 1, updated October 19 UTC) — forums.plex.tv
- Plex, Plex Media Server release announcements — forums.plex.tv
- NVD, CVE-2026-96652 — nvd.nist.gov / CVE-2026-96654 — nvd.nist.gov / CVE-2026-96655 — nvd.nist.gov / CVE-2026-96656 — nvd.nist.gov
- CISA, advisory data for Plex Media Server (VA-26-266-01) — github.com/cisagov
- CISA, Known Exploited Vulnerabilities Catalog (added October 20, 2026) — cisa.gov
- Security researcher's write-up of the chain, Plex2Shell (October 16, 2026) — zmain.info
- Security researcher's report of exploitation in the wild (October 17, 2026) — boredhackerblog.info
Update history
2026-10-31: First version, based on Plex's security notice, NVD, CISA's advisory data and KEV catalog.
Read next
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Checking for compromise: How to check whether your server was compromised
- Exploited the same month: Exploited edge device vulnerabilities, mid-October 2026
- Response steps: Vulnerability remediation playbook
- Terms: What is SSRF? / What is remote code execution (RCE)? / What is CVSS?