CISA has added CVE-2026-96656, a Plex Media Server flaw that lets an admin user write arbitrary files that may be executed on load, to its Known Exploited Vulnerabilities catalog, confirming active exploitation.
What Is It
CVE-2026-96656 is an external control of file name or path vulnerability (CWE-73) in Plex Media Server. According to NVD, versions before 1.43.3.10861 allow an admin user to write arbitrary files that may be executed on load. Third-party research published as "plex2shell" describes how this may work in practice. It reports that the TranscoderH264Options preference is appended verbatim to x264's option string during transcoding. The same research says the server, at startup, appears to load .so files without checking signatures, execute bits, or symbols. Neither NVD nor the vendor has independently confirmed these implementation details, and they may not cover every affected build or configuration.
CISA notes that this vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Why It Matters
CISA added CVE-2026-96656 to the KEV catalog on 2026-10-20, which confirms active exploitation. A CISA Coordinator SSVC assessment dated 2026-10-20 also changed the exploitation status from "none" to "active" and rates the technical impact as "total."
Scoring:
- CVSS 3.1: 7.2 HIGH (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- CVSS 4.0: 8.6 HIGH
Exploitation needs high privileges, but attack complexity is low and no user interaction is required. CISA lists known ransomware campaign use as "Unknown." The KEV entry is flagged for forensic triage, so organizations covered by the directive must meet CISA's Forensics Triage Requirements, not just patch.
What's Vulnerable
- Product: Plex Media Server
- Affected: versions before 1.43.3.10861
- Unaffected: 1.43.3.10861
The NVD CPE configuration lists versionEndExcluding as 1.43.0.10861, which does not match the 1.43.3.10861 boundary in the CVE description and affected-version data. The vendor advisory title refers to "v1.43.2 and earlier." Treat any build below 1.43.3.10861 as vulnerable.
Patch Status
The fixed version is 1.43.3.10861. CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance. If mitigations are unavailable, stop using the product. Stakeholders must evaluate each asset's internet exposure.
Federal due date: 2026-10-23.
Sources
- CISA KEV Catalog – CVE-2026-96656
- NVD – CVE-2026-96656
- CVE.org Record
- Plex Forums – Important Security Update for Plex Media Server v1.43.2 and Earlier
- Plex Media Server Release Notes
- CISA CSAF Advisory VA-26-266-01
- zmain.info – plex2shell
- Bored Hacker Blog – Plex Vulnerabilities Being Exploited
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)