Plex Media Server flaw exploited, added to CISA KEV (CVE-2026-96656)
At a glance
| Severity | CRITICAL |
|---|---|
| CVSS | CVE-2026-96656: 8.6 |
| EPSS (30-day exploit probability) | CVE-2026-96656: 0.8% |
| In CISA KEV (exploited) | Yes, due 2026-10-23 |
| Vendor | Plex |
| CVE IDs | CVE-2026-96656 |
CISA has added a Plex Media Server flaw, CVE-2026-96656, to its Known Exploited Vulnerabilities (KEV) catalog, which means it is being exploited in the wild. Federal agencies must apply mitigations by 2026-10-23, and any organisation running Plex Media Server should treat the same date as its own deadline, per the CISA KEV entry.
The flaw lets an admin user write arbitrary files that are later executed when the server loads. CISA notes it can be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96655.
What happened
CISA added the vulnerability to the KEV catalog on 2026-10-20. It is catalogued as “Plex Media Server External Control of File Name or Path Vulnerability” (CWE-73). NVD published the record on 2026-09-23.
According to the NVD description, the preference TranscoderH264Options is appended verbatim to the transcoder’s option string on every transcode. At startup, the server runs all .so files without checking a signature, the execute bit or symbols. An attacker who can write a file through the preference can therefore get code to run the next time the server loads.
CISA’s entry says the issue can be chained with three other Plex Media Server CVEs listed above. Details of how the chain works, and who is exploiting it, are not disclosed in the sources we reviewed. Known ransomware campaign use is listed as “Unknown”.
Am I affected?
NVD lists the affected range as:
- Plex Media Server versions before 1.43.3.10861
Versions at or after 1.43.3.10861 are outside the affected range in the NVD record. Whether other Plex products are affected is not disclosed.
Technical details
- CVSS: 8.6 (High) under CVSS 4.0. The vector is network-reachable, low complexity, no user interaction, but it requires high privileges (
PR:H), with high impact on confidentiality, integrity and availability. - Weakness: CWE-73, external control of file name or path.
- EPSS: 0.00816, which is a low modelled probability of exploitation. That is a prediction, and KEV listing confirms exploitation has been observed, so KEV status should win when you prioritise.
- KEV: added 2026-10-20, due 2026-10-23, ransomware use unknown.
The high-privilege requirement is worth noting. The description says “an admin user”, so the flaw alone does not give an anonymous internet user code execution. Because the advisory describes chaining with other CVEs, the practical risk depends on whether an attacker can reach admin rights some other way. That is our analysis, not a confirmed attack description.
Why this matters
This section is analysis, not new facts. A media server is often treated as a hobby or home service, but it frequently runs on a general-purpose host with access to storage and the local network. Code execution there can be a foothold. A short deadline from CISA, one day after the catalogue entry date plus a few days, signals that CISA sees active use and wants fast action.
The low EPSS score should not slow you down. EPSS estimates future exploitation, while KEV records that exploitation already happened. If a server is internet-exposed, patch within hours rather than waiting for a normal maintenance window.
What to do
- Find every Plex Media Server instance, including ones run by individuals or small teams outside IT asset inventory.
- Upgrade to version 1.43.3.10861 or later, which is the fixed boundary in the NVD record.
- Where you cannot update immediately, restrict access to the server and its admin interface to trusted networks and remove direct internet exposure.
- Review admin accounts and remove any you do not recognise, since exploitation needs admin access.
- Apply CISA’s required action: follow vendor mitigation instructions and BOD 26-04 guidance, or stop using the product if mitigations are unavailable.
Detection and hunting ideas
No indicators of compromise appear in the sources, so these ideas follow from the described behaviour rather than from observed attacks:
- Check the
TranscoderH264Optionspreference for unexpected or unusually long values. - Look for new or recently modified
.sofiles in the Plex installation and data directories, especially files created outside an update. - Review Plex admin logins and preference changes shortly before any new file appeared.
- Watch for unusual child processes or outbound connections from the Plex service account after a restart.
- If you find signs of tampering, follow CISA’s forensics triage requirements referenced in the KEV entry before rebuilding the host.
Bottom line
The flaw needs admin access, but it is confirmed exploited, it is chainable with three other Plex CVEs, and the deadline is 2026-10-23. Upgrade to 1.43.3.10861 or later, lock down access to the admin interface and hunt for unexpected shared libraries on any server that was exposed.
