CVE-2026-96656 explained: the Plex Media Server flaw and how to fix it

The two-minute check

1. Open Plex Media Server and go to Settings, then General, then About. Note the version number shown there.
2. Compare that number to 1.43.3.10861. If your version is older, you are affected.
3. Check whether this server is reachable from outside your office network, such as through remote access or a port forward. That increases how exposed it is.

When you can stop reading

If you do not run Plex Media Server anywhere in your business, on a computer, phone, or server, this record does not apply to you. You can close this tab. The record names only Plex Media Server as the affected product, so no other software is in scope here.

What the official record says

This flaw carries a score of 7.2 out of 10, rated HIGH, under Common Vulnerability Scoring System (CVSS) version 3.1 (NVD). The scoring detail says an attacker needs network access and no user has to click anything, but the attacker must already hold admin-level credentials on the server. If that condition is met, the flaw lets an admin account write a file that can be run automatically, affecting confidentiality, integrity, and availability of the server.

The Exploit Prediction Scoring System (EPSS) puts the probability of exploitation in the next 30 days at 0.76%, which sits at the 54.661th percentile among all scored flaws. That is a low chance of exploitation in the next 30 days. EPSS is a short-term forecast, not a measure of how damaging the flaw would be if it is used.

This bug is on the Known Exploited Vulnerabilities (KEV) catalog maintained by the Cybersecurity and Infrastructure Security Agency (CISA KEV), which means it has already been used in real attacks. The same update that fixes it also closes three related issues, listed as CVE-2026-96654, CVE-2026-96655, and CVE-2026-96652. You only need to install one update to cover all four.

What that means for a business like yours

The admin-credential requirement limits who can pull this off. But if an employee's admin login to Plex Media Server is weak, reused, or phished, an attacker could use it to plant code that runs automatically on your server. Given that it is already on the exploited list, this is not a theoretical risk. It is worth fixing on a normal schedule, not an emergency one.

If someone else manages your IT

Send your provider something like this:

• "Do we run Plex Media Server anywhere in our business?"
• "If so, please update it to version 1.43.3.10861 or later."
• "This covers CVE-2026-96656 and three related fixes in the same update. Please confirm when it's done."

If you do not have a managed provider handling this kind of patching, our managed IT services team can take it on for you.

If you manage it yourself

1. Open Plex Media Server on the computer, phone, or server it runs on.
2. Go to Settings, then General, then About. Check for an available update.
3. If one is offered, click the update or install button and let it finish.
4. If no update is offered automatically, visit the Plex Media Server release notes forum to confirm the current build.
5. Restart the server application once the update completes.
6. Review who holds admin-level access to your Plex Media Server account. Remove anyone who no longer needs it.

The federal remediation due date on the CISA KEV catalog for this flaw is October 23, 2026. Because it is already being exploited, the honest answer is: now. There is no safe waiting window here, even though the exploitation forecast itself is low.

Do not trust a progress bar alone. Reopen Plex Media Server after the update finishes. Go back to Settings, then General, then About, and confirm the version reads 1.43.3.10861 or later. If it still shows an older number, the update did not complete and you need to run it again.

If you cannot update immediately, remove any remote or internet-facing access to the server until you can. That does not fix the flaw, but it narrows who can reach it. Also review and tighten admin-level accounts on the server, since this flaw depends on an attacker already holding one. Our cybersecurity services team can help you review access while you plan the update, and our privileged access management service can help lock down who holds admin rights longer term.

Do I have to do anything if we only use this at home?

This guide is written for a business setting, but the same check applies anywhere Plex Media Server runs. If your version is older than 1.43.3.10861, update it regardless of where it sits.

Will updating break anything?

The record does not list any compatibility issues tied to this update. A vendor shipping a fix like this is routine maintenance, not a sign of a larger problem.

Do I need to involve a compliance team?

If your business handles regulated health or financial data anywhere near this server, it is worth documenting that you patched it. Our FTC Safeguards Rule guidance covers what that kind of documentation should look like.

What if we don't know who manages our admin accounts?

That is worth sorting out regardless of this flaw, since admin-level access is exactly what this bug depends on. A free IT assessment can tell you who has access to what across your systems.

How quickly can LayerLogix help if we need it?

We offer business-hours support with after-hours emergency response, backed by 20+ years of experience and 100% U.S.-based support. Contact us if you want help confirming your Plex Media Server is patched today.