{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "plex-media-server",
  "name": "Plex Media Server",
  "short_name": "Plex",
  "page_url": "https://patchgap.ai/is-my-plex-up-to-date/",
  "minimum_safe_version": "1.43.3",
  "minimum_safe_version_source": [
   {
    "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
    "title": "Plex forum: Important security update for Plex Media Server 1.43.2 and earlier",
    "date": "2026-09-01",
    "kind": "vendor"
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652",
    "title": "NVD: CVE-2026-96652",
    "date": "2026-09-23",
    "kind": "nvd"
   }
  ],
  "baseline": {
   "version": "1.43.3",
   "applies_to": "all platforms listed for this product",
   "source_incident": "plex-media-server-plex2shell-attacks",
   "sources": [
    {
     "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
     "title": "Plex forum: Important security update for Plex Media Server 1.43.2 and earlier",
     "date": "2026-09-01",
     "kind": "vendor"
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652",
     "title": "NVD: CVE-2026-96652",
     "date": "2026-09-23",
     "kind": "nvd"
    }
   ],
   "covers_everything_listed": true,
   "caveats": [],
   "text": "You're covered against everything listed here if you're on Plex 1.43.3 or newer."
  },
  "update_steps": {
   "windows": [
    "Open Plex Web > Settings > General (under your server).",
    "Install the update it offers, or download it from plex.tv."
   ],
   "macos": [
    "Open Plex Web > Settings > General (under your server).",
    "Install the update it offers, or download it from plex.tv."
   ],
   "linux": [
    "Open Plex Web > Settings > General (under your server).",
    "Install the update it offers, or download it from plex.tv."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Plex",
  "category": "apps",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "what_it_is": "The app that turns a computer into a home movie and music server.",
  "url": "https://patchgap.ai/is-my-plex-up-to-date/",
  "json_url": "https://patchgap.ai/products/plex-media-server.json",
  "official_site": "https://www.plex.tv",
  "official_download": "https://www.plex.tv/media-server-downloads/",
  "how_it_updates": "Turn on automatic updates in Plex Media Server settings, or download the newest version from the official downloads page.",
  "check": {
   "windows": {
    "menu_path": "Open Plex Media Server's app or tray icon and look for its version (About or Settings). You can also open Plex in your web browser and go to Settings.",
    "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Plex Media Server*' | Select-Object DisplayName,DisplayVersion",
    "shell": "PowerShell",
    "read_only": true
   },
   "macos": {
    "menu_path": "Look for the Plex Media Server icon in the menu bar and open its About window.",
    "command": "defaults read \"/Applications/Plex Media Server.app/Contents/Info\" CFBundleShortVersionString",
    "shell": "Terminal",
    "read_only": true
   },
   "linux": {
    "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
    "command": null,
    "shell": null,
    "read_only": null
   }
  },
  "open_incidents": [
   "plex-media-server-plex2shell-attacks"
  ]
 },
 "incidents": [
  {
   "id": "plex-media-server-plex2shell-attacks",
   "url": "https://patchgap.ai/incidents/plex-media-server-plex2shell-attacks/",
   "path": "/incidents/plex-media-server-plex2shell-attacks/",
   "json_url": "https://patchgap.ai/incidents/plex-media-server-plex2shell-attacks.json",
   "title": "Plex Media Server: hackers are chaining bugs to break in. Update to 1.43.3 or newer.",
   "category": "apps",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "plex-media-server"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "Rated by us as high. CISA says attackers chain this bug with others. NVD rates the single bug 5.3 (medium).",
   "exploited_in_wild": "yes",
   "exploited_note": "CISA added four Plex Media Server bugs to its list of bugs used in real attacks on Oct 20, 2026, and says they can be chained together.",
   "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-20",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-96652",
    "CVE-2026-96654",
    "CVE-2026-96655",
    "CVE-2026-96656"
   ],
   "summary": "If you run Plex Media Server on a PC or Mac, hackers can use a chain of bugs to take over that computer. The US government (CISA) says this is happening now. Plex fixed the problems in Plex Media Server 1.43.3. Plex Desktop 1.115.0 got security fixes too. Update both if you use them.",
   "am_i_affected": "You are at risk if you run Plex Media Server older than 1.43.3 and it can be reached from the internet or your home network. People who only use the Plex app to watch (not the server) are not affected by the server bug.",
   "action": "Update Plex Media Server to 1.43.3 or newer",
   "affected": [
    {
     "product": "plex-media-server",
     "product_name": "Plex Media Server",
     "platform": "windows",
     "affected_versions": "Plex Media Server 1.43.2 and older",
     "fixed_version": "1.43.3 (build 1.43.3.10861)",
     "fixed_min": "1.43.3",
     "fix_note": null,
     "fixed_source_urls": [
      "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-96652"
     ],
     "check": {
      "menu_path": "Open Plex Media Server's app or tray icon and look for its version (About or Settings). You can also open Plex in your web browser and go to Settings.",
      "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Plex Media Server*' | Select-Object DisplayName,DisplayVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://www.plex.tv/media-server-downloads/"
    },
    {
     "product": "plex-media-server",
     "product_name": "Plex Media Server",
     "platform": "macos",
     "affected_versions": "Plex Media Server 1.43.2 and older",
     "fixed_version": "1.43.3 (build 1.43.3.10861)",
     "fixed_min": "1.43.3",
     "fix_note": null,
     "fixed_source_urls": [
      "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-96652"
     ],
     "check": {
      "menu_path": "Look for the Plex Media Server icon in the menu bar and open its About window.",
      "command": "defaults read \"/Applications/Plex Media Server.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://www.plex.tv/media-server-downloads/"
    },
    {
     "product": "plex-media-server",
     "product_name": "Plex Media Server",
     "platform": "linux",
     "affected_versions": "Plex Media Server 1.43.2 and older",
     "fixed_version": "1.43.3 (build 1.43.3.10861)",
     "fixed_min": "1.43.3",
     "fix_note": null,
     "fixed_source_urls": [
      "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-96652"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://www.plex.tv/media-server-downloads/"
    }
   ],
   "fix_steps": [
    "Go to the official Plex Media Server downloads page.",
    "Download the newest version for your computer and install it over the old one.",
    "Or turn on automatic updates in Plex Media Server's settings.",
    "If your server is on a NAS box, ask its maker for the update, or install the package by hand.",
    "Do not leave your server open to the internet if you do not need to."
   ],
   "official_patch_links": [
    {
     "label": "Plex: official Media Server downloads",
     "url": "https://www.plex.tv/media-server-downloads/"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
     "title": "CISA: Known Exploited Vulnerabilities catalog (CVE-2026-96652, -96654, -96655 and -96656, added Oct 20, 2026)",
     "date": "2026-10-20",
     "kind": "cisa",
     "official": true
    },
    {
     "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319",
     "title": "Plex forum: Important security update for Plex Media Server 1.43.2 and earlier",
     "date": "2026-09-01",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652",
     "title": "NVD: CVE-2026-96652",
     "date": "2026-09-23",
     "kind": "nvd",
     "official": true
    }
   ]
  }
 ]
}