CVE-2026-96656
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
0/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
CISA Known Exploited Vulnerability
Vendor / Product
Plex — Media Server
Date Added
2026-10-20
Remediation Due
2026-10-23
https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| plex | media_server | < 1.43.3.10861 |
References & Advisories (6)
US Government Resource
Third Party Advisory
VDB Entry
Third Party Advisory
Third Party Advisory
Third Party Advisory
Release Notes