The CVE record says an authenticated user can request arbitrary internal or external addresses through the path parameter. Plex's own summary words it differently, as disclosure of the server owner's admin token. CISA added it to its Known Exploited Vulnerabilities catalog on 20 October 2026.
What it allows
The CVE record says Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the /video/:/transcode/universal path parameter. In the Plex2Shell chain the authenticated user is the attacker holding a stolen owner token.
The researcher says the transcoder fetches attacker-hosted media with no allowlist of hosts. The attacker uses this to bring a prepared video file onto the server. The file is then written into the Codecs folder with the file write described in CVE-2026-96656.
The sources do not agree on the wording of this CVE. The CVE record describes the transcode request forgery.
Plex's table of 19 October says disclosure of the owner's admin token. We follow the CVE record for what the flaw is and note Plex's wording because owners will see both.
Plex2Shell is the name for the chain of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. CISA's entry for each one says it can be chained with the other three. See how Plex2Shell chains the four CVEs in our news post.
In our checks on 23 October 2026, a GitHub search for this CVE id returned 3 repositories, the earliest created on 17 October. We did not run or link any of them.
Who is affected
Plex Media Server before build 1.43.3.10861, according to the CVE record. Plex says 1.43.3.10861 and later are not affected.
Plex's post title says 1.43.2 and earlier, while its 19 October update gives the build number as the cutoff. Use the build number. The researcher's README names builds up to 1.43.3.10828 as vulnerable, so an early 1.43.3 build can still be affected.
Plex's update guide covers Windows, macOS, Linux, NAS devices and Docker. Plex says an internet-reachable server older than 1.43.3.10861 should be assumed possibly compromised.
Timeline
- 1 Sep 2026
Plex announces Plex Media Server 1.43.3 as a security release and says CVEs have been requested.
- 23 Sep 2026
The CVE record is published, with CISA as the CVE numbering authority.
- 16 Oct 2026
A public proof of concept is released, according to Plex.
- 19 Oct 2026
Plex publishes the CVE details and says the flaws are being actively and widely exploited.
- 20 Oct 2026
CISA adds the CVE to the Known Exploited Vulnerabilities catalog.
- 3 Nov 2026
The CISA due date for US federal agencies.
What to do
-
Check your version
Open Plex Web, go to Settings, then General, and read the version. Anything older than 1.43.3.10861 is affected. Compare all four numbers of the build, not only 1.43.3.
-
Update now
Install Plex Media Server 1.43.3.10861 or later. On a NAS the package manager may be behind, so Plex says to download the package from its Downloads page and install it by hand.
-
Cut exposure
If you do not need remote access, turn it off under Settings, then Remote Access. Plex also advises against forwarding port 32400 directly unless you need it.
-
Do not test the transcode path
Do not send requests to the transcode paths to test a server. Read the version in Plex Web. Then watch for outbound connections you do not recognize and for sustained high CPU while nothing is playing, both of which Plex lists as signs of compromise.
-
Rebuild if you cannot rule out a compromise
Plex advises a clean installation instead of reusing the old data directory. Sign out of all devices in your Plex account, change the password, and treat anything the Plex service account could reach as exposed.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Is CVE-2026-96655 being exploited?
Plex says the flaws in this chain are being actively and widely exploited, and CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on 20 October 2026. CISA lists use in ransomware campaigns as unknown.
Which Plex Media Server version fixes it?
Plex Media Server 1.43.3.10861 and later. Check Settings, then General, in Plex Web, and compare all four numbers of the build.
Do I need to turn off remote access?
Plex advises turning off Remote Access if you do not need it and not forwarding port 32400 directly unless you need it. Updating is still required.
Does CVE-2026-96655 leak the owner's admin token?
Plex's table says so, but the CVE record describes a request forgery through the transcode path. Plex2Shell steals the token in an earlier step, according to the researcher.
Does it need a login?
The CVE record says an authenticated user. In the chain, the attacker already holds the owner's admin token by then.
