CVE-2026-96656

HIGHCVSS 7.2Known Exploited

CISA Known Exploited Vulnerability

https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656

Remediation deadline: October 23, 2026

Description

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

Timeline

Published:September 23rd, 2026 5:17 PM

Last modified:September 29th, 2026 6:34 PM

Added to KEV:October 20th, 2026

CVSS Scoring

CVSS v3: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

plex

Products

media_server

Weaknesses (CWE)

CWE-73

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute