Plex Security Update 2026: CVE-2026-96652 Chain and How to Update Your Server

Short answer: According to CISA, four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) were added to its Known Exploited Vulnerabilities catalog on October 20, 2026. Reporting says the fix is in Plex Media Server 1.43.3.10861 or newer, so update now, and turn off Remote Access if you do not need it until you have.

Last reviewed: October 25, 2026.

What happened with Plex Media Server

Here is what we could confirm, with the source for each point. We checked these on October 25, 2026.

• CISA, October 20, 2026: CISA added four Plex Media Server entries to the Known Exploited Vulnerabilities (KEV) catalog. Two are listed as Server-Side Request Forgery (SSRF), one as improper neutralization of encoded URI schemes in a web page, and one as external control of a file name or path. The CISA alert gives no further technical detail.
• Plex forum announcement: A forum thread quotes a Plex announcement titled "Important Security Update for Plex Media Server v1.43.2 and earlier". It says Plex released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues.
• BleepingComputer: It reports that the four flaws, nicknamed Plex2Shell, can be chained into remote code execution on the server, running with the privileges of the Plex process. Other reporting links a related fifth flaw, CVE-2026-96651, to exposure of the account token. It says affected versions are those before 1.43.3.10861, and that exploitation was reported from October 17.
• Cord Cutters News (October 18): It says the exploitation it knew of came from a researcher's honeypot, and that it was not a confirmed large-scale campaign at that time.

We could not open Plex's own support pages or the full Plex announcement directly, so Plex's menu wording below is described in general terms. Check Plex's current documentation if a screen looks different on your device.

Who is at risk

You are most exposed if all of these apply:

• You run Plex Media Server version 1.43.2 or earlier, or any build older than 1.43.3.10861.
• The server is reachable from the internet, for example through Remote Access or port forwarding to port 32400.
• Automatic updates are off, or the server sits on a NAS where the package manager lags behind Plex.

The Plex announcement, as quoted on the forum, notes that on NAS devices the update may not yet appear in the package manager, and that a manual install is possible. A server used only inside your home network has less exposure, but you should still update.

The BleepingComputer report describes the chain's individual flaws as medium to high severity and reportedly rates the full chain as critical (9.8). That is a reason to treat the update as urgent, not a reason to panic.

Step 1: Check your Plex Media Server version

Plex's server settings page shows the installed version number and can check for updates. The usual routes:

1. Open Plex Web on the server computer (typically http://127.0.0.1:32400/web) and sign in.
2. Open the server's settings and look at the About or Status information for the version.
3. Compare it with 1.43.3.10861. Anything lower needs updating. Newer is fine.

Version numbers change fast, so a newer build than 1.43.3.10861 is expected and good.

Step 2: Update on your platform

Back up your Plex library database and settings first if you can. Updating is normally safe, but a backup costs little.

Platform	How to update
Windows	Use the update check in the server settings, or download the current installer from Plex's official download page and run it over the existing install. Your library is kept.
macOS	Same approach: update check in the server settings, or install the current download from Plex's official site.
Linux	Plex's support documentation says Linux installs update through the package manager or a configured repository, not through the in-app button. Run your normal update for the Plex package.
Synology, QNAP and other NAS	Open the NAS package app and check for a Plex update. If it is not offered yet, the Plex announcement says a manual package install is possible. Use the package for your exact NAS model from Plex's official download page.
Docker	Pull the current image and recreate the container. Keep your config volume mapped so settings survive.

For Docker, a typical sequence looks like this. Replace the names with yours:

docker pull plexinc/pms-docker
docker stop plex
docker rm plex
# then recreate the container with the same volumes and settings you used before

If you use Docker Compose, docker compose pull followed by docker compose up -d does the same job. Make sure you use the image name from your existing setup.

After the update, repeat Step 1 and confirm the version is 1.43.3.10861 or higher.

Step 3: Consider turning off Remote Access until patched

Cord Cutters News lists these among recommended actions: disable Remote Access if external connectivity is not required, and limit exposure of port 32400 with network segmentation. We could not confirm this advice on a Plex support page, so treat it as reporting, not a Plex instruction.

In practice:

1. In the server settings, find the Remote Access section and disable it. Plex's documentation places it under the server settings.
2. If you set up manual port forwarding for port 32400 on your router, remove that rule. See our home Wi-Fi router security guide for the general steps.
3. Re-enable access only after the update is confirmed.

One forum report says disabling Remote Access did not stop every outside connection, in that case possibly because of Plex relay. This is an anecdote, so verify after changing settings rather than assuming.

Step 4: Check for signs of compromise

Cord Cutters News reported the following indicators from the attacks it described. They are not a complete list, and a clean result is not proof that nothing happened.

• The Codecs folder: unexpected shared object or DLL files inside the Plex Codecs directory.
• Unexpected child processes: programs launched by the Plex Media Server process. Reported process names include myawesomeproxy, mylovelyminer and x12345.
• Network traffic: connections to the domain proxystream.st.
• Payloads: an XMRig-based cryptocurrency miner and a proxy program that routes outside traffic through your connection.

An earlier scout report also noted high CPU use while the server is idle, a sign that is consistent with a miner but common to many other problems.

Quick checks by system

On Windows, open Task Manager, sort by CPU while Plex is idle, and look at the Details tab for names you do not recognise. On macOS, use Activity Monitor the same way. On Linux or a NAS with shell access, this lists the process tree:

ps -ef --forest | grep -i plex

To look for a recent file in the Codecs folder, compare file dates with when you last updated Plex. The folder sits inside Plex's application data directory, whose location depends on your platform. Do not delete anything yet. Note names and dates first.

Step 5: If you find something, or cannot rule it out

Cord Cutters News describes a clean reinstall as the most reliable recovery in confirmed cases. A cautious order of work:

1. Disconnect the server from the network. Do not delete evidence yet.
2. Copy your media files and a copy of your Plex data if you want them, and scan the copy before trusting it. Our malware guide and remote virus removal page explain what a cleanup involves.
3. Reinstall the operating system, or at least the Plex install and its data folder, from a clean base.
4. Install the fixed Plex version before reconnecting to the internet.
5. Rotate credentials, as described next.

If the server is on a NAS that holds other files, treat the whole NAS as in scope and review its accounts and scheduled tasks. Our guide to signs a device is hacked covers wider warning signs.

Account and password hygiene

Because the attack can reportedly expose account tokens, rotating credentials is reasonable if compromise is possible. We did not find an official Plex page for the exact steps, so this follows common forum guidance from a Plex moderator, which you should confirm in the Plex account settings:

1. Change your Plex account password, ideally from a device you trust.
2. Choose the option to sign out of all devices, then confirm which devices remain listed and remove the ones you do not recognise.
3. Sign the server back in locally if it was signed out.
4. Review who your libraries are shared with and remove anyone you do not know.
5. Turn on two-step verification on your Plex account if available, and use a unique password. Our password manager guide and MFA guide help here.

Also change passwords on anything that shares a login with the machine, such as a NAS admin account.

Prevent the next one

• Turn on automatic updates for Plex and for the operating system. A forum reply in the discussion made the same point.
• Do not forward ports you do not need.
• Keep the server off machines that hold personal files if you can.
• Keep an offline backup.

If you would like a technician to walk through the update and the checks with you, our remote repair service and Windows support do this over a screen share.

What we could not confirm

• The exact wording of Plex's own advisory and support pages. They were not accessible to us, so we relied on a quoted announcement, CISA, BleepingComputer and Cord Cutters News.
• The scale of exploitation. Reporting on October 18 described a honeypot, and later activity is not documented in sources we could verify.
• Whether the indicator names above are exhaustive.

Frequently asked questions

Which Plex version fixes the 2026 security flaws?

BleepingComputer and Cord Cutters News both say 1.43.3.10861 or newer. The Plex announcement as quoted on its forum names 1.43.3 and says versions 1.43.2 and earlier are affected.

What does CISA say about Plex?

CISA's alert of October 20, 2026 added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalog.

Do I need to turn off Remote Access?

It is not required once you have updated. Cord Cutters News suggests disabling it if you do not need outside access, which lowers exposure while you patch.

Is my server hacked if I am on an older version?

Not necessarily. An old version is exposed, but that does not mean it was attacked. Use the checks above to look for signs.

Does updating Plex remove malware?

No. An update closes the hole but does not remove software already planted. If you see the indicators, plan a clean reinstall.

Can I update a Plex server on a NAS?

Yes. Use the NAS package manager, or a manual package install if the update is not offered yet, as the Plex announcement describes.

Do I need to update Plex Desktop too?

The Plex announcement quoted on the forum names Plex Desktop 1.115.0 alongside the server release, so update it too.

Should I change my Plex password?

If compromise is possible, yes. Change it, sign out other devices and review shared users.