DEV Community

jeffrey
jeffrey

Posted on

Checking a Plex Media Server for compromise after the 1.43.3 fixes

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

Checking a Plex Media Server for compromise after the 1.43.3 fixes

Plex's own wording sets the tone. If a server runs a build older than 1.43.3.10861 and was reachable from the internet, the vendor says to assume it may be compromised. That sentence is unusual in a security notice and it changes the job from patching to triage.

Why the vendor says assume compromised

The four CVEs fixed in 1.43.3 chain into remote code execution without authentication. CVE-2026-96652 provides an unauthenticated SSRF through the player timeline, CVE-2026-96654 reaches internal agent functions over loopback, CVE-2026-96655 discloses the owner's admin token, and CVE-2026-96656 writes files the service executes at startup. A public proof of concept appeared on 2026-10-16, and Plex reports widespread attacks on unpatched internet-facing servers afterwards, with compromised hosts used for cryptocurrency mining and proxy software.

Nothing in that sequence leaves a clean log line by default, which is why the vendor points at artefacts rather than at a single request.

First question: which build is running

Open Plex Web, go to Settings, then General, and read the version. Anything below 1.43.3.10861 is in scope for the chain. NAS packages are the usual laggard: Plex notes that vendor stores such as QNAP may not have the update immediately and that manual installation of the package may be required. Plex Desktop 1.115.0 ships separately from the server.

Artefacts to inspect on the host

Three checks cover most of what the advisory describes.

Processes started by Plex Media Server that you do not recognise. Plex names myawesomeproxy, mylovelyminer and x12345 as examples seen in the wild. The list is not exhaustive, so treat any unexplained child process of the Plex service as suspicious.

Unfamiliar .so or .dll files in the Plex Codecs folder. This is the payload location for CVE-2026-96656, because the server runs shared objects from that directory at startup without signature, execute bit or symbol checks. Record hashes and timestamps before deleting anything.

Outbound connections to proxystream.st and sustained high CPU use while nothing is playing. The first suggests the proxy role the advisory describes, the second the miner role.

Configuration drift that signals tampering

Read Preferences.xml and compare transcoder options with your own documentation. The write primitive in CVE-2026-96656 works because TranscoderH264Options is appended verbatim to the x264 option string on every transcode, so a preference you never set is evidence of administrative access you did not grant. The same file can show remote access settings enabled after your last review.

Scope what the service account could reach

The advisory asks operators to treat anything the Plex service account could reach as potentially exposed. In practice that means mounted SMB or NFS shares, credentials stored on the same host or VM, and any bookmark or token sitting in the Plex data directory. Inventory those before rebuilding, because the rebuild destroys the evidence you would need to answer questions about lateral movement.

Rebuild instead of cleaning

Plex recommends rebuilding from a clean installation rather than reusing the old data directory. A defensible order of operations:

  1. Snapshot the host for later analysis if policy allows.
  2. Copy Preferences.xml and a listing of Codecs files to a safe location.
  3. Build a new server on a clean host or a fresh VM.
  4. Restore media libraries only, not application state.
  5. Sign out all devices in Plex account settings and change the Plex password.
  6. Rotate every credential that was stored on the compromised host.

Rebooting without those steps leaves the loader in place. The malicious shared object persists on disk and returns at the next start.

Reducing the next window

Turn off remote access under Settings, then Remote Access, if nobody uses it. Avoid forwarding port 32400 directly, which Plex recommends as a standing measure. A reverse proxy that enforces authentication in front of the Plex web UI does not fix the four CVEs, but it narrows the population that can reach the vulnerable endpoints while a patch window is open.

What the CISA deadlines imply

CISA added all four identifiers to the Known Exploited Vulnerabilities catalog on 2026-10-20. The due dates split the chain: 2026-10-23 for CVE-2026-96656 and CVE-2026-96654, and 2026-11-03 for CVE-2026-96652 and CVE-2026-96655. CVE-2026-96656 also carries a forensic triage requirement, which fits an issue whose payload sits in a directory you can inspect.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared, while vul.cve="CVE-2026-96654" returned 0. The product count describes internet-facing Plex installations, not hosts confirmed vulnerable or compromised, and it says nothing about patch level.

References

Top comments (0)