Plex Media Server rarely runs on a laptop. It runs on a NAS, a container or a small home server, and those are exactly the platforms where a security update can take extra days to appear. For a chain that is being exploited in the wild, packaging is a security control.

The update path differs by platform

The Plex notice for the 1.43.3 release lists the update route for each platform, and none of them is instant.

Windows and macOS users who enabled automatic updates only need to confirm the installed version is 1.43.3 or newer. Otherwise the installer comes from the Plex downloads page.

On Ubuntu the package is a .deb installed with dpkg, and the notice's example shows plexmediaserver_1.19.4.2935-79e214ead_amd64.deb. On Fedora and CentOS the equivalent is an .rpm through dnf. Docker installations follow the pms-docker repository README rather than a package manager.

NAS devices go through the vendor's app store. The Plex release notes state that not all app stores, naming QNAP as an example, will have the update immediately and that manual installation may be required.

Why the lag is a security problem here

For a routine bug, waiting for a package is an inconvenience. For this chain it widens the window in which an internet-facing server is exploitable without authentication. Plex states that a public proof of concept appeared on 2026-10-16 and that attacks on unpatched servers have been widespread since, using compromised hosts for cryptocurrency mining and proxy software.

A NAS makes that worse in two ways. It is usually left running, so the vulnerable service is reachable continuously. And it often holds data far beyond media: backups, shared folders and credentials the Plex service account can read.

Checking the installed version

Open Plex Web, go to Settings, then General, and read the version string. The fixed build is 1.43.3.10861 and later. A version that starts with 1.43.3 but ends in a lower build number is not automatically safe, so compare the whole string.

Plex Desktop 1.115.0 is a separate product with its own release. Updating the desktop client does not update a server on a NAS.

Installing by hand when the store lags

The notice describes the manual route for NAS systems in general terms: download the package for the device from the Plex downloads page, open the NAS web interface, find the app store section (the name differs by vendor), pick the manual install path and follow the vendor's wizard. Plex links per-vendor guides for QNAP, Terramaster, Western Digital, Netgear and Synology.

For Linux hosts, the package name in the example is older than the current release, so substitute the file you actually downloaded. Running dpkg -i or dnf install against a stale filename leaves the old build in place, which looks like a successful upgrade until the version is checked again.

What to do on a device that cannot be patched quickly

If the NAS package is not available yet, reduce reachability in the meantime. Turn off remote access under Settings, then Remote Access, when nobody needs it. Stop forwarding port 32400 directly. Restrict who can reach the web UI to trusted networks or a VPN.

None of those steps fixes CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 or CVE-2026-96656, and Plex does not present them as fixes. They only shrink the population that can reach the vulnerable endpoints while the package is pending.

After the update on a NAS

Check the version again after the reboot, because NAS installers sometimes stage an update that completes later. If the device was reachable from the internet before the patch, run the vendor's compromise checks: unrecognised processes such as myawesomeproxy, mylovelyminer or x12345, new .so or .dll files in the Codecs folder, outbound connections to proxystream.st, and high CPU with nothing playing. Plex's advice for exposed servers is to assume compromise and rebuild from a clean installation.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared. The CVE-specific query vul.cve="CVE-2026-96654" returned 0. The product figure counts reachable Plex installations, not unpatched NAS devices, and no external scan can report which package store a given server depends on.

References

  • Plex security notice with platform update instructions: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

  • Plex release note about app store availability: https://forums.plex.tv/t/plex-media-server/30447/711

  • CVE-2026-96654 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96654

  • CVE-2026-96656 record: https://nvd.nist.gov/vuln/detail/CVE-2026-96656

  • CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654