If you run Plex Media Server on a PC or Mac, hackers can use a chain of bugs to take over that computer. The US government (CISA) says this is happening now. Plex fixed the problems in Plex Media Server 1.43.3. Plex Desktop 1.115.0 got security fixes too. Update both if you use them.
- Status
- Patched: update now
- Being attacked?
- Yes[1]
- Severity
- High
- Updated
CISA added four Plex Media Server bugs to its list of bugs used in real attacks on Oct 20, 2026, and says they can be chained together. Severity: Rated by us as high. CISA says attackers chain this bug with others. NVD rates the single bug 5.3 (medium). First reported .
Am I affected?
You are at risk if you run Plex Media Server older than 1.43.3 and it can be reached from the internet or your home network. People who only use the Plex app to watch (not the server) are not affected by the server bug.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Plex Media Server | Windows | Plex Media Server 1.43.2 and older | 1.43.3 (build 1.43.3.10861)[2][3] |
| Plex Media Server | Mac | Plex Media Server 1.43.2 and older | 1.43.3 (build 1.43.3.10861)[2][3] |
| Plex Media Server | Linux | Plex Media Server 1.43.2 and older | 1.43.3 (build 1.43.3.10861)[2][3] |
How to check your version
These checks only look. They do not change anything on your computer.
Plex Media Server on Windows
Easy way: Open Plex Media Server's app or tray icon and look for its version (About or Settings). You can also open Plex in your web browser and go to Settings.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Plex Media Server*' | Select-Object DisplayName,DisplayVersion
Plex Media Server on Mac
Easy way: Look for the Plex Media Server icon in the menu bar and open its About window.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
defaults read "/Applications/Plex Media Server.app/Contents/Info" CFBundleShortVersionString
Plex Media Server on Linux
Easy way: Open the app and look in its Help or About menu, or check your software manager.
How to fix it
- Go to the official Plex Media Server downloads page.
- Download the newest version for your computer and install it over the old one.
- Or turn on automatic updates in Plex Media Server's settings.
- If your server is on a NAS box, ask its maker for the update, or install the package by hand.
- Do not leave your server open to the internet if you do not need to.
More on each app: Is my Plex up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/plex-media-server-plex2shell-attacks.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Sources
- CISACISA: Known Exploited Vulnerabilities catalog (CVE-2026-96652, -96654, -96655 and -96656, added Oct 20, 2026) (Oct 20, 2026)
- MakerPlex forum: Important security update for Plex Media Server 1.43.2 and earlier (Sep 1, 2026)
- NVDNVD: CVE-2026-96652 (Sep 23, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.