High severity7.2CISA KEVNVD Advisory· Published Sep 23, 2026· Updated Oct 21, 2026
CVE-2026-96656
CVE-2026-96656
Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.43.3.10861
Patches
Vulnerability mechanics
References
6- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonnvdThird Party Advisory
- www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.htmlnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party AdvisoryVDB Entry
- zmain.info/blog/plex2shellnvdThird Party Advisory
- forums.plex.tv/t/plex-media-server/30447/711nvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
7- ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and MoreThe Hacker News · Oct 26, 2026
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard FlawsThe Hacker News · Oct 21, 2026
- Plexcor: 4 Actively-Exploited Flaws Added to CISA KEVVypr Intelligence · Oct 20, 2026
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy BackdoorThe Hacker News · Oct 19, 2026
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After DisclosureSecurityWeek · Oct 19, 2026
- Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer MalwareCyber Security News · Oct 19, 2026
- CISA Adds Six Known Exploited Vulnerabilities to CatalogCISA Alerts