Snapshot of public data from 30 Oct 2026, 10:41:14. This data is not updated until the API is deployed.

CVE-2026-96656

Plex Media Server External Control of File Name or Path Vulnerability

UrgentCVSS 8.6 v4.0Exploited

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

Affected products

Vendor	Product	Versions
Plex	Media Server	before 1.43.3.10861

Revision history

Revision 2 30 Oct 2026, 10:18:44
Update : Affected versions changed
Revision 1 30 Oct 2026, 10:17:21
New record

Qualification

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 8.6 HIGH CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Listed
Exploitation: Confirmed
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1

CISA KEV catalog

Added on: 20 October 2026
Federal due date: 23 October 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use: Unknown