Zero Radar
← feed
CriticalVulnerabilityCVE-2026-96656updated 25 Oct 2026, 17:20 UTC

Plex Media Server lets admins write files that run automatically

A flaw in Plex Media Server can let someone with admin rights plant a file that the server then runs on its own, which can take control of the server. Attackers are already using this flaw.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.6 of 10
Being exploited?YesConfirmed by CISA KEV · 20 Oct 2026
Fix available?YesPlex Media Server 1.43.3.10861 or later · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Admin accountAttacker needs admin access first
  2. 2Set transcoder optionMalicious value added to x264 options
  3. 3Write .so fileArbitrary file planted on disk
  4. 4Server startupAll .so files loaded without checks
  5. 5Code executesPlanted file runs on the server
  6. ResultAttacker runs code on the server

What happened

Plex Media Server versions before 1.43.3.10861 allow an admin user to write arbitrary files via external control of file name or path. The TranscoderH264Options preference is appended verbatim to x264's option string, and at startup all .so files are loaded without signature, execute-bit, or symbol checks.

Why it is dangerous: Malicious files can be written and executed when the server loads, potentially giving full control of the host, and the flaw can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Anyone running an affected Plex Media Server is at risk, especially servers exposed to the internet.

Are you affected?

You are affected if you run Plex Media Server older than 1.43.3.10861 and have admin accounts that could be misused or compromised.

Plex Media Server before 1.43.3.10861

What to do

  1. Update Plex Media Server to version 1.43.3.10861 or later
  2. Restrict admin access to trusted users only and change admin passwords
  3. Remove Plex Media Server from direct internet exposure if it cannot be updated immediately
  4. Review the server for unexpected .so files or changed transcoder settings, following CISA forensics triage guidance

Timeline

  1. 23 Sept 2026, 18:31 UTC
    Publicly disclosed
  2. 20 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:20 UTC
    Fix: Plex Media Server 1.43.3.10861 or later

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-96656 · GHSA-2g2v-9wf5-6m3g
CVSS
8.6 / 10
EPSS
1.8% chance of exploitation within 30 days
Disclosed
23 Sept 2026, 18:31 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Plex Media Server lets admins write files that run automatically · Zero Radar