CVE-2026-96656: plex media_server

CVSS 8.6 (high) · listed as exploited by CISA since 2026-10-20 · published 2026-09-23

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Affected products (NVD): plex media_server

Fixed in (NVD): 1.43.3.10861

Weakness: CWE-73

Source: NVD CVE-2026-96656

References

• https://forums.plex.tv/t/plex-media-server/30447/711
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-96656
• https://zmain.info/blog/plex2shell
• https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.