Is CVE-2026-96656 exploited in the wild?

Yes. CVE-2026-96656 is known to be exploited in the wild, first recorded on 20 October 2026. Treat it as urgent.

How severe is CVE-2026-96656?

Critical severity, with a CVSS score of 7.2, published 23 September 2026.

Which products and versions are affected?

Plex Media Server before 1.43.3.10861.

Is there a fix for CVE-2026-96656?

A patch was published on 2026-09-23: Fixed in version 1.43.3.10861 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96656 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-96656?

Check whether you run Plex Media Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96656: Plex Media Server arbitrary file write in transcoder options

CVE-2026-96656 · Severity: critical · CVSS 7.2 · Exploited in the wild · Published 2026-09-23

Plex Media Server, a media streaming platform used in homes and offices, contains a vulnerability that allows an authenticated administrator to write arbitrary files that may be executed by the application. An attacker with admin access could exploit this through transcoding settings to execute malicious code on the server hosting the media library.

Technologies: Plex Media Server. Vendors: Plex.

Quick answers

Is CVE-2026-96656 exploited in the wild?: Yes. CVE-2026-96656 is known to be exploited in the wild, first recorded on 20 October 2026. Treat it as urgent.
How severe is CVE-2026-96656?: Critical severity, with a CVSS score of 7.2, published 23 September 2026.
Which products and versions are affected?: Plex Media Server before 1.43.3.10861.
Is there a fix for CVE-2026-96656?: A patch was published on 2026-09-23: Fixed in version 1.43.3.10861 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96656 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-96656?: Check whether you run Plex Media Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An admin user can inject arbitrary parameters into the TranscoderH264Options preference, which is appended verbatim to x264's command-line options during transcoding. At startup, the application loads .so (shared object) files without signature verification, execute bit checks, or symbol validation. An attacker with admin credentials can write malicious .so files and trigger their execution during server startup or transcode operations.

Affected products

Plex Media Server before 1.43.3.10861

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in version 1.43.3.10861

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.