Vulnerability details

CVE-2026-96656

Actively exploited

Plex Media Server

Plex Media Server arbitrary file write

CVSS 4.0

8.6High

Official description

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (cisa-cg)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.2High	3.1	CVEProject cvelistV5 (CNA) (cisa-cg)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Plex	Media Server	v < 1.43.3.10861	CVEProject cvelistV5 (CNA)

References and advisories

https://forums.plex.tv/t/plex-media-server/30447/711 release-notes
https://www.cve.org/CVERecord?id=CVE-2026-96656 vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json third-party-advisory
https://zmain.info/blog/plex2shell third-party-advisory
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-23
Last updated: 2026-10-21
State: Published
Assigner (CNA): cisa-cg
Kolun priority: 73 · High

CISA KEV catalog

Date added: 2026-10-20
Due date: 2026-10-23
Used in ransomware: Unknown

Exploit prediction (EPSS)

1.78%

Probability of exploitation in 30 days

78.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-73
External Control of File Name or Path