CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 20, 2026

CVSS 8.6 · High⚠ Actively exploited (CISA KEV)

8.6

CVSS score

High

Severity

Active

CISA KEV

Ransomware use

Oct 23, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, with a federal patch deadline of Oct 23, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Details

AffectedPlex · Media Server

WeaknessCWE-73

CVSS base score8.6 (High)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PublishedSep 23, 2026

Added to CISA KEVOct 20, 2026

Federal patch deadlineOct 23, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2026-96656 being actively exploited?

Yes — CISA lists CVE-2026-96656 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2026-96656 affect?

CVE-2026-96656 affects Plex · Media Server.

How do I fix CVE-2026-96656?

Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 23, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities