CISA adds Plex arbitrary file-write flaw to KEV (CVE-2026-96656)
Original title: CISA KEV: Plex Media Server External Control of File Name or Path Vulnerability — Plex Media Server (CVE-2026-96656)
An admin can write files that load as unsigned .so modules on Plex before 1.43.3.10861; due date is October 23.
CISA listed CVE-2026-96656, affecting Plex Media Server before 1.43.3.10861, in the Known Exploited Vulnerabilities catalog. An admin user can write arbitrary files that may run on load because TranscoderH264Options is appended verbatim to x264’s option string. At startup, all .so files run without signature, execute-bit, or symbol checks. The KEV due date is October 23, 2026.
Unconfirmed: CISA lists known ransomware campaign use as Unknown.
- Requires an admin user to write the files.
- TranscoderH264Options is appended to the x264 option string.
- Startup loads every .so without signature checks.
- Due date is October 23, 2026.
Impact: Admin can write files later executed on load
| Product | Affected |
|---|---|
| Plex Media Server | before 1.43.3.10861 |
- 1.Apply vendor mitigations under BOD 26-04.
- 2.Stop using the product if no mitigation exists.
- 3.Remediate by the October 23, 2026 due date.
- CVEs
- CVE-2026-96656
- Vendors
- Plex
- Products
- Plex Media Server
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96656 | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 | 2% | KEV | KEV |
From the original article
1 min read at cisa.govPlex Media Server before 1. 43. 3.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.