CVE-2026-96656: listed in the CISA KEV catalog

CVE-2026-96656 · CVSS 7.2 HIGH · EPSS 2% · KEV 2026-10-20 · patch available

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Is CVE-2026-96656 exploited?

• Listed in the CISA KEV catalog on 2026-10-20.
• Federal remediation due 2026-10-23.
• Past that date by 14 days.
• EPSS puts exploitation in the next 30 days at 2%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Plex · Media Server · >= 0, < 1.43.3.10861

Is there a patch?

Yes. Update to one of these or later:

From Plex's CVE record

What PlainSec published about CVE-2026-96656

• Plex2Shell puts QNAP NAS storage at risk (2026-11-06)
• PHP2Shell draws millions of attempts, but no success observed (2026-10-27)
• Exploitation spans Plex, Siemens, SiteGuard and a separate ClickFix lure (2026-10-21)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-11-06.