In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

TL;DR: Plex says four flaws in Plex Media Server, now known as Plex2Shell, “are being actively and widely exploited.” Chained together, they let an unauthenticated attacker run code on the server. Compromised servers have been used to mine cryptocurrency and to route other people’s traffic through the owner’s internet connection. On October 20, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added all four to its Known Exploited Vulnerabilities (KEV) catalog. The fix is Plex Media Server 1.43.3.10861 or later. Plex’s advice: if your server is older and reachable from the internet, “assume it may be compromised.”

What happened

Plex first told server owners on September 1, 2026, that Plex Media Server 1.43.3 fixed “a number of security issues.” In a follow-up posted on October 19 at 20:17 UTC (October 20, 4:17 a.m. Manila), Plex published the CVE details:

  • CVE-2026-96652: unauthenticated server-side request forgery in the player timeline endpoint.
  • CVE-2026-96654: access to internal agent functions over the loopback interface.
  • CVE-2026-96655: disclosure of the server owner’s admin token, in Plex’s description. The CVE record, from CISA, describes it as a server-side request forgery that lets an authenticated user make the server request arbitrary internal or external addresses.
  • CVE-2026-96656: arbitrary file write to the Codecs directory through transcoder preferences.

Plex says a public proof of concept was released on October 16 and that it has since seen “widespread attacks against internet-facing servers that haven’t been updated.” Versions 1.43.3.10861 and later are not affected.

CISA added all four CVEs to the KEV catalog on October 20. It gave US federal agencies until October 23 to fix CVE-2026-96654 and CVE-2026-96656, and until November 3 for the other two. That deadline only binds federal agencies, but KEV is a useful priority list for everyone.

Why it matters

Small offices, studios and creators sometimes run Plex on a NAS or a spare PC to share video, training material or client footage, often with remote access switched on. That same machine frequently holds shared drives, backups or saved passwords. Plex warns that anything the Plex service account could reach should be treated as potentially exposed, so a hijacked media server can become a way into the rest of your files and network.

What to do now

  1. Check your version. In Plex Web, open Settings → General. If it shows anything older than 1.43.3.10861, you’re affected.
  2. Update. On Windows and macOS, confirm automatic updates actually installed 1.43.3.10861 or newer, or download it from Plex’s Downloads page. On Ubuntu or Debian, install the new .deb with dpkg -i. On Fedora or CentOS, install the .rpm with dnf install. For Docker, follow the pms-docker README. Plex warns that NAS package centers may not have the new build yet, so download the package for your device and use your NAS’s manual install option.
  3. Look for signs of compromise. Plex lists processes started by Plex Media Server that you don’t recognize (it names myawesomeproxy, mylovelyminer and x12345), unfamiliar .so or .dll files in the Plex Codecs folder, outbound connections to proxystream.st, and sustained high CPU while nothing is playing.
  4. If you find any of these, or can’t rule out compromise, rebuild the server from a clean install rather than reusing the old Plex data directory. Plex says that at a minimum you should delete everything in the Codecs folder and check Preferences.xml for transcoder options you didn’t set. Then sign out of all devices from your Plex account, change your Plex password, and rotate any credentials stored on the same machine or VM.
  5. Close the door you don’t need. If you don’t use remote access, turn it off under Settings → Remote Access, and avoid forwarding port 32400 directly.

Patching servers today? Also check our stories on the critical PHP security release and the GitLab CVSS 10 patch.

Updates

  • Oct 23, 2026, 10:40 a.m. Manila: First published. We’ll add a dated note here if Plex updates its advisory or CISA changes the listing.

Sources & method

Sources

Method. Last checked October 23, 2026, at 10:40 a.m. Manila time (02:40 UTC). The CVE summaries, fixed version, exploitation details, signs of compromise and update steps come from Plex’s forum post. The KEV dates and federal deadlines come from CISA’s catalog feed. Where a CVE record describes a flaw differently from Plex, we say so. The “Why it matters” section and the advice to rotate stored credentials are our own judgment, built on Plex’s guidance. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.