CVE-2026-96656: Plex Media Server Arbitrary File Write (KEV)

CVE-2026-96656 is an arbitrary file write in Plex Media Server, caused by an unsanitized transcoder preference string and unchecked loading of shared-object files at startup, that Plex says can be chained with other flaws fixed in the same release to let an unauthenticated remote attacker run code with the Plex Media Server process's privileges; CISA added it to KEV on 2026-10-20 after public proof-of-concept exploitation and widespread in-the-wild attacks.

CVE-2026-96656 is an external control of file name or path issue (CWE-73) in Plex Media Server. NVD's description states: "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks" (NVD).

NVD lists the CVE as "Analyzed" and records a CVSS v3.1 base score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 8.6 (high) — network-reachable with low attack complexity, but requiring the attacker to already hold admin-level privileges on the Plex instance, with high impact to confidentiality, integrity and availability (NVD).

Plex's own security update post for Media Server 1.43.3 groups CVE-2026-96656 with three other fixed CVEs — an unauthenticated SSRF in the player-timeline endpoint (CVE-2026-96652), exposure of internal agent functions over the loopback interface (CVE-2026-96654), and disclosure of the server owner's admin token (CVE-2026-96655) — and states that "when chained, these flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process," that the issues are "being actively and widely exploited," that a public proof of concept was released on 2026-10-16, and that compromised servers have been used to run cryptocurrency miners and proxy software (Plex Security Advisory).

CISA added CVE-2026-96656 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20 with a required-action due date of 2026-11-03, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-22, FIRST scores the probability of exploitation at 0.00816 (56.6th percentile) (FIRST EPSS).

Given confirmed, widespread in-the-wild exploitation of the chained flaws against internet-facing servers, Plex Media Server operators should update to 1.43.3.10861 or later immediately, check for unfamiliar files in the Codecs directory and suspicious processes or outbound connections, and rebuild from a clean installation and reset Plex credentials if compromise is suspected.

• Admin-level users can write arbitrary files via the unsanitized TranscoderH264Options preference; Plex loads .so files at startup without signature, execute-bit or symbol checks (CWE-73). — NVD
• CVSS v3.1 base score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 score is 8.6 (high), per NVD status Analyzed. — NVD
• Plex groups this CVE with 3 other fixed CVEs (96652, 96654, 96655); when chained they let an unauthenticated remote attacker run code with Plex Media Server's privileges; actively and widely exploited since a 2026-10-16 public PoC, including cryptomining and proxy abuse on compromised servers. — Plex Security Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-20, due date 2026-11-03, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.00816 (56.6th percentile) as of 2026-10-22. — FIRST EPSS