CVE-2026-96656
Plex Media Server
What this is
Plex Media Server has a flaw that lets an administrator write files of their choice. These files may run as programs when the software starts.
How it can harm you
Someone with administrator access can exploit the flaw over a network to write arbitrary files and potentially run their own program on the server. No interaction from another person is needed.
How urgent it is
This vulnerability is already being used in attacks. Update the affected software to prevent this flaw from being used on your server.
Who is affected
Plex Media Server versions before 1.43.3.10861 are affected.
What to do
Update Plex Media Server to 1.43.3.10861. Consult the vendor advisory for verified update instructions.
How to check your server
Find the installed version of Plex Media Server and compare it with the affected and fixed versions in the vendor advisory.
Technical details
- CVE
- CVE-2026-96656
- Published
- September 23, 2026
- CWE
- CWE-73
- CVSS
- 8.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.8% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.