Plex says attackers are exploiting a chain of four flaws against internet-facing Plex Media Servers. Its October 19 security update warns that an exposed server older than 1.43.3.10861 may already be compromised.

The fixed server release predates this warning. Plex first recommended updating to 1.43.3 on September 1; it later published the CVE details and reported active attacks. CISA added the four flaws to its Known Exploited Vulnerabilities catalog on October 20. That is the catalog-addition date, not the date exploitation began.

Why a login is not required for the complete chain

Plex describes four linked weaknesses:

  • CVE-2026-96652: unauthenticated server-side request forgery, which makes the server send a request chosen by an attacker.
  • CVE-2026-96654: access to internal agent functions through the server’s own loopback interface.
  • CVE-2026-96655: a further request-forgery issue; Plex describes its role in the chain as disclosing the owner’s administrator token.
  • CVE-2026-96656: an administrator-level arbitrary file write that can place executable files in the Codecs directory.

The last step’s administrator requirement does not mean the complete attack requires an administrator to cooperate. Earlier steps supply access that later steps use. Plex says the combined result is unauthenticated remote code execution with the Plex server process’s privileges.

What is known about attacks

Exploitation status: vendor-reported active attacks, corroborated by CISA’s exploited-vulnerability listings. Plex reports compromised servers running unauthorized proxy software, routing other people’s traffic through victims’ connections. It dates a public demonstration to October 16.

Plex’s account establishes observed abuse, but supplies no reliable total of compromised servers. CISA’s catalog independently marks the vulnerabilities as exploited; it does not establish that every exposed installation was breached.

Patch the service, then assess the machine

  1. Install Plex Media Server 1.43.3.10861 or newer. Check the running server version in Plex Web under Settings → General. Updating a playback client alone does not patch the server.
  2. Check beyond the package version. Plex flags unfamiliar child processes, unexpected .so or .dll files in its Codecs directory, and sustained CPU use when nothing is playing.
  3. Rebuild when compromise is found or cannot be ruled out. Plex recommends a clean installation rather than carrying forward the old data directory. A patch does not remove previously installed malware.
  4. Contain account and downstream access. Follow Plex’s advice to sign out all devices and change the account password. Review mounted shares and credentials reachable by the Plex service account.
  5. Remove unnecessary remote exposure. Plex recommends disabling Remote Access when it is unneeded and avoiding direct forwarding of port 32400 unless required.

NAS package catalogs can lag the vendor release. Use Plex’s platform-specific update guidance and verify what actually runs after updating.

Caveat: missing malware indicators do not establish a clean server; Plex explicitly recommends treating exposed older installations as potentially compromised.