Plex actively exploited (CISA KEV): update to 1.43.3.10861

Plex Media Server versions older than 1.43.3.10861 are affected by four vulnerabilities that Plex says are being actively and widely exploited, and CISA added all four to its Known Exploited Vulnerabilities catalog on 20 October 2026. Update to 1.43.3.10861 or newer. If the old server was reachable from the internet, check it for compromise.

Which Plex servers are affected?

Any self-hosted Plex Media Server older than 1.43.3.10861. That covers Windows, macOS, Linux, Docker and NAS installs. Plex's warning is aimed at servers reachable from the internet. It does not say servers behind a firewall are immune, and we do not claim they are.

A Plex server is not a website, so most site owners are not in scope. You are if you, a client or a colleague runs Plex on the same network or machine as business systems, because Plex says to treat anything the service account could reach as exposed.

What do the four CVEs do?

Plex describes them as:

• CVE-2026-96652: unauthenticated server-side request forgery in the player timeline endpoint.
• CVE-2026-96654: access to internal agent functions over the loopback interface.
• CVE-2026-96655: disclosure of the server owner's admin token.
• CVE-2026-96656: arbitrary file write to the Codecs directory through transcoder preferences.

Plex says chaining them lets an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. CISA's catalog entries use different short descriptions for CVE-2026-96654 and CVE-2026-96655 than Plex's list, and the KEV catalog flags CVE-2026-96656 as needing forensic triage. We follow Plex's wording for what each bug is and CISA's for exploitation status. We do not reproduce exploit steps and you do not need them.

What is the trap with this one?

Two things.

1. The fix is almost three months old. Plex released 1.43.3.10861 on 4 August and published its security notice on 1 September. Servers on automatic updates may be fine. On a NAS the update may not show up: Plex's September post says it may not be available in the package manager yet and can be installed manually (at our check on 28 October 2026). Plex gives no figures on how many NAS servers are affected.
2. The fixed build is 1.43.3.10861, not just "1.43.3". Check the full version string, not the first three numbers.

CISA's due dates apply to federal civilian agencies under BOD 26-04. CISA encourages all organisations to prioritise KEV items, and it does so for old bugs too, as in its 2015-era additions.

How do I fix it?

Plex's own order is: update, check for compromise, rebuild if needed, reduce exposure. We follow it.

• Open Plex Web, go to Settings, then General, and read the server version.
• If it is older than 1.43.3.10861, update. Windows and macOS: download from Plex's Downloads page or confirm automatic updates. Linux: install the .deb or .rpm package. Docker: follow the pms-docker README. NAS: download the package for your device and install it manually. Methods are as listed in Plex's 1 September post.
• Check for the signs Plex lists (next section).
• If anything is found, or you cannot rule it out, rebuild from a clean installation instead of reusing the old data directory.
• Sign out of all devices, change the Plex password, and treat anything the Plex service account could reach as exposed.
• If you do not need Remote Access, turn it off under Settings, then Remote Access. Avoid forwarding port 32400 directly.

The longer lockdown steps for a home or small-office box are on a separate Plex hardening page.

If a vendor or managed provider runs Plex for you, send them this:

Is our Plex Media Server on 1.43.3.10861 or newer? If it was older and reachable from the internet, Plex says to assume it may be compromised, so did you check it for the indicators in Plex's 19 October notice, and what else could the Plex service account reach?

Was my server exploited before I patched?

Plex says attacks against unpatched internet-facing servers were widespread, with compromised servers used for cryptocurrency mining and proxy software. Plex's indicators are:

• Unrecognised processes. Plex names examples such as "myawesomeproxy", "mylovelyminer" and "x12345".
• Unfamiliar .so or .dll files in the Codecs folder.
• Outbound connections to proxystream.st.
• Sustained high CPU while nothing is playing.
• Transcoder options in Preferences.xml that you did not set.

The same mining pattern turns up on exposed Docker and Redis ports. Updating does not remove anything planted earlier. A server that passes these checks has no indicator Plex lists. That is not proof it was never reached.

What should I read next?

Plex is one of several October 2026 incidents, and another self-hosted server with a critical flaw is GitLab's CVSS 10.0 RCE. More like these are in the other incident write-ups. The running tracker of this month's incidents keeps the dated status of each, and the October 2026 security checklist covers where to start this week. CISA's KEV catalog is the place to re-check status, because entries and notes can change.