CVE-2026-96656
published 2026-09-23CVE-2026-96656: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is…
PriorityP182high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-10-23
Exploited in the wild
EPSS
1.79%
78.1th percentile
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| plex | media_server | < 1.43.3.10861 | 1.43.3.10861 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck7.2HIGH
cisa4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96654 [MEDIUM] CWE-84 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Vulnerability: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Affected: Plex Media Server
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailabl
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96655 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
CISA
Plex Media Server External Control of File Name or Path Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96656 [MEDIUM] CWE-73 Plex Media Server External Control of File Name or Path Vulnerability
Vulnerability: Plex Media Server External Control of File Name or Path Vulnerability
Affected: Plex Media Server
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asse
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96652 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the prod
GHSA
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.
ghsa_unreviewed·2026-09-23
CVE-2026-96656 [HIGH] CWE-73 Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
VulnCheck
plex media_server External Control of File Name or Path
vulncheck·2026·CVSS 7.2
CVE-2026-96656 [HIGH] plex media_server External Control of File Name or Path
plex media_server External Control of File Name or Path
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Affected: plex media_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
No detection rules found.
No public exploits indexed.
Hackernews
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
blogs_hackernews·2026-10-21·CVSS 8.5
CVE-2026-96652 [HIGH] CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell .
The vulnerabilities are listed below -
CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability
CVE-2026-9665
Hackernews
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
blogs_hackernews·2026-10-19·CVSS 6.5
CVE-2026-96652 [MEDIUM] Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.
According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell .
The vulnerabilities are below -
CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by ta
https://forums.plex.tv/t/plex-media-server/30447/711https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonhttps://www.cve.org/CVERecord?id=CVE-2026-96656https://zmain.info/blog/plex2shellhttps://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656
2026-09-23
Published
2026-10-20
Added to CISA KEV
Exploited in the wild