CVE-2026-96656
Arbitrary file write in Plex Media Server lets admin attacker execute code on load.
Plex Media Server has a flaw where an admin can write arbitrary files that run on startup. This is in versions before 1.43.3.10861. The vulnerability is being actively exploited; it is on CISA's known-exploited list, and U.S. federal agencies must fix by 2026-10-23.
Plex Media Server · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 23 Oct
SeverityhighCVSS 8.6 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Media Server 1.43 | 1.43.3.10861 |
What to do
- Update Plex Media Server to version 1.43.3.10861 or later, which fixes this issue.
- Restrict admin access to trusted users only, as the flaw requires admin privileges.
- Follow CISA's guidance: federal agencies must apply the fix by 2026-10-23.
What happened
- 20 OctCISA adds CVE-2026-96656 to its known-exploited vulnerabilities catalog, noting active exploitation and setting a 2026-10-23 deadline for federal agencies.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-96656 | Plex Media Server arbitrary file write | high 8.6 | 20 Oct | 1.8% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-96656 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works