Important Security Update for Plex Media Server v1.43.2 and earlier

Announcements
1

We recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible. CVEs have been requested and we’ll reply to this thread with more details once they’re published.

If you’re running Plex Media Server on a NAS device, the updated version may not be available in their package manager yet but you can install the package manually. Here’s a quick guide on how to update Plex Media Server by platform.

Windows

  • If you have automatic updates turned on, make sure that you’re on the latest version, 1.43.3 or newer

  • To manually update your Plex Server, go to our Downloads page and download the most recent version.

MacOS

  • If you have automatic updates turned on, make sure that you’re on the latest version, 1.43.3 or newer

  • To manually update your Plex Server, go to our Downloads page and download the most recent version.

Linux

  • Ubuntu

    • Download the .deb package from our Downloads page

    • Run sudo dpkg -i plexmediaserver_1.19.4.2935-79e214ead_amd64.deb (replacing the last filename with the name of the package you downloaded)

  • Fedora/CentOS

    • Download the .rpm package from our Downloads page

    • run sudo dnf install plexmediaserver-1.19.4.2935-79e214ead.x86_64.rpm (replacing the last filename with the name of the package you downloaded)

  • NAS Devices

    • Download the installation package appropriate to your device from our Downloads page

    • Follow the NAS manufacturer’s installation procedure to install the Plex Media Server

    • If you have problems, visit the Plex Media Server NAS forums and search for your device for help

Docker

NAS systems

  • Generally speaking, start with downloading the proper files from our Downloads page

  • Access your NAS web interface

  • Select the App Store

    • Naming will be different across vendors (App Center, Applications, App Store)

  • There will be a path to Manually Install

    • Paths will be different across vendors (Dedicated button, inside Settings, etc)

  • Follow install wizard

For specific instructions, see below:
QNAP Guide, Terramaster Guide, WD Guide, Netgear Guide, and Synology Guide

NVIDIA Shield

  • Open the Google Play store and install any pending updates
3

Update: CVE details and active exploitation

As promised in the original post, here are the CVE details for the issues fixed in Plex Media Server 1.43.3.

  ┌────────────────┬─────────────────────────────────────────────────────────────────────────────┐
  │      CVE       │                                   Summary                                   │
  ├────────────────┼─────────────────────────────────────────────────────────────────────────────┤
  │ CVE-2026-96652 │ Unauthenticated server-side request forgery in the player timeline endpoint │
  ├────────────────┼─────────────────────────────────────────────────────────────────────────────┤
  │ CVE-2026-96654 │ Access to internal agent functions over the loopback interface              │
  ├────────────────┼─────────────────────────────────────────────────────────────────────────────┤
  │ CVE-2026-96655 │ Disclosure of the server owner's admin token                                │
  ├────────────────┼─────────────────────────────────────────────────────────────────────────────┤
  │ CVE-2026-96656 │ Arbitrary file write to the Codecs directory through transcoder preferences │
  └────────────────┴─────────────────────────────────────────────────────────────────────────────┘

Chained together, these issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. Plex Media Server 1.43.3.10861 and later are not affected.

These vulnerabilities are being actively and widely exploited. A public proof of concept was released on October 16.

Since then, we’ve seen widespread attacks against internet-facing servers that haven’t been updated. Compromised servers have been used to run cryptocurrency miners and proxy software, which routes other people’s traffic through the victim’s internet connection.

If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.

What you should do

  1. Update now. Make sure your server is on 1.43.3.10861 or newer: open Plex Web, go to Settings → General, and check the version shown. Update instructions for each platform are in the original post above.
  2. Check for signs of compromise:
    • Processes started by Plex Media Server that you don’t recognize, especially names like myawesomeproxy, mylovelyminer or x12345.
    • Unfamiliar .so or .dll files in the Plex Codecs folder.
    • Outbound connections to proxystream.st, or sustained high CPU use while nothing is playing.
  3. If you find any of these, or you can’t rule out compromise:
    • Rebuild the server from a clean installation rather than reusing the old Plex data directory. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options you didn’t set.
    • Sign out of all devices from your Plex account settings, and change your Plex password.
    • Treat anything the Plex service account could reach as potentially exposed, such as mounted shares and credentials stored on the same machine or VM.
  4. If you don’t need remote access, turn it off under Settings → Remote Access. Avoid forwarding port 32400 directly unless you need it.