Patch Now: CISA Confirms Attacks on Plex Media Server Flaw CVE-2026-96656

CISA has confirmed in-the-wild exploitation of CVE-2026-96656, an external control of file name or path flaw affecting Plex Media Server. The agency added the vulnerability to its KEV catalog on October 20, 2026.

At a glance

CVE

CVE-2026-96656

Vendor

Plex

Product

Media Server

CVSS

8.6 HIGH

Weakness

external control of file name or path

Exploited

Yes (CISA KEV)

Ransomware use

Unknown

Patch deadline (FCEB)

October 23, 2026

What we know about CVE-2026-96656

CISA's catalog entry describes the issue as follows: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

The National Vulnerability Database lists a CVSS base score of 8.6 (High).

The NVD record adds: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Affected products

Why this matters

CISA does not currently link this vulnerability to ransomware campaigns, but KEV listings mean exploitation has already been observed. Under CISA's binding operational directives, Federal Civilian Executive Branch agencies must remediate it by October 23, 2026. CISA urges every organisation, not only federal agencies, to treat KEV entries as a patching priority.

What should you do?

• Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• Apply the vendor's fix or mitigation now; CISA lists the bug as exploited in real attacks.
• If no patch is available, follow the vendor's workaround or take the product offline.
• Check logs on exposed systems for signs of compromise before and after patching.
• Restrict management interfaces so they are not reachable from the internet.

What to do and how to stay safe: CVE-2026-96656

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96656?

CVE-2026-96656 is a external control of file name or path vulnerability in Plex Media Server.

How severe is CVE-2026-96656?

It has a CVSS score of 8.6 HIGH.

Is CVE-2026-96656 being exploited?

Yes. CISA lists it in its Known Exploited Vulnerabilities catalog, which means attacks have been observed.

What is the deadline to patch CVE-2026-96656?

US federal civilian agencies must remediate it by October 23, 2026. Other organisations are urged to treat it as a priority.