Running Plex at the bar, the office or home? Update to 1.43.3

What it is

Plex is the media server a lot of bars, gyms and offices use to put their own music and video on the TVs, and plenty of owners run one at home. Four flaws were published together on September 23 and CISA confirmed on October 20 that attackers are using them.

Two let the server be tricked into making requests on the attacker’s behalf (CVE-2026-96652 and CVE-2026-96655), one lets an attacker call other plugins’ functions with their own parameters (CVE-2026-96654), and the last lets an admin-level session write files that run when the server starts (CVE-2026-96656, CVSS 8.6). The NVD records say they can be chained, which is how a request from outside ends with code running on the machine.

Update

1. Check the versionIn Plex, Settings, then General (or Troubleshooting on some versions) shows the server version. You need 1.43.3.10861 or later.
2. Update the serverOn Windows and Mac, the Plex Media Server tray icon offers the update. On a NAS or Linux box, update the Plex package from the device’s app center or package manager.
3. Don’t leave it on a work computerIf the Plex server shares a machine with the point-of-sale, accounting or office files, move it. A media server doesn’t need to sit next to your money.
4. Turn off remote access you don’t useIf nobody streams from outside the building, switch off Remote Access in Plex settings so the server isn’t reachable from the internet at all.

Sources

• Plex forum: Plex Media Server release notes
• CISA advisory data (CSAF) for these flaws
• NVD: CVE-2026-96656
• NVD: CVE-2026-96652
• CISA Known Exploited Vulnerabilities catalog