CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

CISA's alert lists the flaw as "CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability"[3] and was one of six entries added to its catalog.Strix describes the flaw this way: "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load."[4] According to SentinelOne, at startup Plex loads all .so files without verifying signatures, execute bits, or expected symbols.[5]Censys reports that on its own the bug scores 7.2[2]. It adds that the chain is serious "because the flaw scored 7.2 requires admin access, and the earlier flaws give an unauthenticated attacker that access."[2]According to SecurityOnline, attackers began exploiting the vulnerabilities on October 17, 2026, one day after researcher Zach Main published full details and PoC code[6]. BetaNews, however, says the write-up came out on October 16, "the same day exploitation began in earnest."[7]Censys reports that Plex's October 19 notice says compromised servers have been used to run cryptocurrency miners and proxy software[2].BetaNews reports Plex saying that builds numbered 1.43.3.10861 and later are not affected.[7] According to Censys, Plex says a server older than 1.43.3.10861 that was reachable from the internet should be treated as one that may be compromised[2].A GitHub tracker citing the CISA catalog lists a KEV remediation due date: 2026-10-23[8].