Vulnerability Intelligence Report
Plex Media Server arbitrary file write
CVE-2026-96656
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
8.6
HIGH
EPSS Probability:0.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-73 ↗CWE-73 External Control of File Name or Path
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Plex | Media Server | 0 < 1.43.3.10861 (affected), 1.43.3.10861 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · CERT · USA |
| Reserved | 2026-09-23T14:42:33 |
| Published | 2026-09-23T16:07:10 |
| Patch Date | 2026-08-03 |
| Last Updated | 2026-10-20T19:58:23 |
Community Chatter & Buzz