What’s Vulnerable › Vulnerabilities
CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-20
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-10-21
- Weakness: CWE-73
Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Summary
Plex Media Server before 1.43.3.10861 lets an admin user write arbitrary files that may be executed on load: the TranscoderH264Options preference is appended verbatim to x264's option string on every transcode, and at startup all .so files run without signature, execute-bit, or symbol checks. This high-severity flaw (CVSS 7.2) can lead to arbitrary code execution on the server. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, though EPSS puts 30-day exploitation probability at 1.8%. Update to Plex Media Server 1.43.3.10861 or later, and follow CISA BOD 26-04 guidance, including evaluating internet exposure and applying forensics triage requirements.
تسمح Plex Media Server قبل الإصدار 1.43.3.10861 لمستخدم إداري بكتابة ملفات عشوائية قد تُنفَّذ عند التحميل، إذ يُضاف تفضيل TranscoderH264Options حرفيًا إلى سلسلة خيارات x264 في كل عملية transcode، وتُشغَّل جميع ملفات .so عند بدء التشغيل دون التحقق من التوقيع أو بت التنفيذ أو الرموز. قد تؤدي هذه الثغرة عالية الخطورة (CVSS 7.2) إلى تنفيذ تعليمات برمجية عشوائية على الخادم. وهي مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، رغم أن EPSS يقدّر احتمال الاستغلال خلال 30 يومًا بنسبة 1.8%. يجب التحديث إلى Plex Media Server 1.43.3.10861 أو أحدث، واتباع إرشادات CISA BOD 26-04 بما يشمل تقييم تعرض الأصول للإنترنت وتطبيق متطلبات الفحص الجنائي.
Affected products
- Plex Media Server: before 1.43.3.10861 — fixed in 1.43.3.10861
How to fix
Upgrade to a fixed version: Plex Media Server 1.43.3.10861. Check the vendor advisory for mitigations.
References
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-96656
- https://zmain.info/blog/plex2shell
- https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656
Get alerted when CVE-2026-96656 or the next vulnerability affects your stack