TI-2026-63829 Aliases CVE-2026-96656 GHSA-2g2v-9wf5-6m3g

Arbitrary file write in Plex Media Server enables code execution

CRITICAL 96Exploited in the wildCWE-73Published 2026-09-23 · Updated 2026-10-21

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Plex Media Server before 1.43.3.10861 has an external control of file path flaw (CWE-73) that lets an admin user write arbitrary files. The TranscoderH264Options preference is appended unchecked to the x264 option string on every transcode, and at startup all .so files load without signature or symbol checks, so written files may run. CISA lists this flaw in KEV with a date added of 2026-10-20, and its SSVC assessment marks exploitation as active.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-20CISA due date 2026-10-23

EPSS 0.01785 78th percentileScored 2026-11-07

Fix Fixed Media Server (Plex): 1.43.3.10861

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Plex	Media Server	before 1.43.3.10861	1.43.3.10861	Patch available	CNA

Media Server VendorPlex Affected before 1.43.3.10861 Fixed in 1.43.3.10861 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:plex:media_server::::::::	before 1.43.3.10861	Vulnerable	Plex

cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:* Versions before 1.43.3.10861 Vulnerable ·Plex

Remediation

Upgrade Plex Media Server to version 1.43.3.10861, the fixed version. CISA requires U.S. federal agencies to fix it by 2026-10-23.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA Media Server (Plex) Fixed in 1.43.3.10861

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-23
Plex Media Server 1.43.3.10861
5 records Highest priority Priority CRITICAL 2 CRITICAL, 2 HIGH, 1 LOW
Other records, highest priority first
- TI-2026-63827 Plex Media Server URL injection lets attackers call other pluginsPriority CRITICAL 88
- TI-2026-63828 Server-side request forgery in Plex Media ServerPriority HIGH 81
- TI-2026-63826 Server-side request forgery in Plex Media ServerPriority HIGH 81
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-96656
2026-10-03 Alias added: GHSA-2g2v-9wf5-6m3g
2026-10-20 Added to CISA KEV
2026-10-20 CISA SSVC decision points changed
2026-10-21 EPSS moved to the 50th–90th percentile
2026-10-21 CISA SSVC decision points changed
2026-10-21 Priority changed: LOW → CRITICAL

References

Advisory 4

Other 1

TI-2020-04669 Deserialization of untrusted data in Plex Media Server KEVCVSS 3.1HIGH 7.2
TI-2026-63827 Plex Media Server URL injection lets attackers call other plugins KEVCVSS 4.0MEDIUM 6.9
TI-2026-63828 Server-side request forgery in Plex Media Server KEVCVSS 4.0MEDIUM 5.3
TI-2026-63826 Server-side request forgery in Plex Media Server KEVCVSS 4.0MEDIUM 5.3
TI-2025-42857 Incorrect authorization in Plex Media Server CVSS 3.1HIGH 8.5
TI-2021-13235 Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. CVSS 3.1HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences