CVE-2026-96656: Plex Media Server

What is CVE-2026-96656?

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

CVSS7.2 NVD 3.1

SeverityHIGH

Exploitation In the wild

EPSS<1% · P32

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWECWE-73

NVD published2026-09-23

NVD last modified2026-10-20

Timeline

2026-09-23Published to the U.S. National Vulnerability Database (NVD)
2026-10-20First covered in a defend.network daily briefing
2026-10-20NVD record last updated

Affected product

Plex Media Server

References

Referenced in our briefings & reports

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits (2026-10-20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.

What is CVE-2026-96656?

Timeline

Affected product

References

Referenced in our briefings & reports

Get Critical CVE Alerts