CVE-2026-96656 and 3 related: Plex Media Server multiple critical flaws enable file write, SSRF, and cross-plugin attack
Plex Media Server before version 1.43.3.10861 contains four distinct actively exploited vulnerabilities including arbitrary file write (CWE-73), server-side request forgery via two endpoints (CWE-918), and URL-scheme mishandling (CWE-84). Together, these allow admin users to achieve code e
Plex Media Server's transcode and plugin functionality contains overlapping defects that permit privilege escalation, lateral attacks, and external network access abuse. The highest-severity flaw (CVE-2026-96656, CVSS 7.2) allows an admin user to write arbitrary .so files that are executed without verification at startup. Two SSRF vulnerabilities (CVE-2026-96655 and CVE-2026-96652) let authenticated or token-bearing users make the server contact internal/external systems. A plugin URL-handling flaw (CVE-2026-96654) bypasses URL encoding controls to call arbitrary plugin functions.
| CVEs | CVE-2026-96656 (CVSS 7.2), CVE-2026-96654 (CVSS 6.5), CVE-2026-96655 (CVSS 4.3), CVE-2026-96652 (CVSS 4.3) |
|---|---|
| Severity | High (highest CVSS 7.2) |
| Actively exploited | Yes (CVE-2026-96656, CVE-2026-96654, CVE-2026-96655, CVE-2026-96652), listed in CISA's Known Exploited Vulnerabilities catalog on 20 Oct 2026 |
| CISA remediation deadline | 23 Oct 2026 |
| Weakness | CWE-73, CWE-84, CWE-918 (server-side request forgery (SSRF)) |
| Attack vector | Network |
| Privileges required | High |
| User interaction | None |
| Published | 23 Sept 2026 |
How the attack works
The arbitrary file write occurs when the TranscoderH264Options preference is appended directly to x264's command line and .so files in the transcode directory are loaded and executed at startup without signature or permission validation. SSRF attacks exploit two separate transcode paths: /video/:/transcode/universal accepts arbitrary path parameters, and /player/timeline accepts a 'protocol' parameter containing full URLs. The plugin vulnerability fails to neutralize URL values in the 'searchOne' parameter, allowing attackers to construct URLs that call unintended plugin functions with attacker-supplied arguments.
Who is affected
Plex Media Server versions before 1.43.3.10861 are affected. This includes all older releases and any instance not updated to 1.43.3.10861 or later.
Affected products listed:
- Plex Media Server (before 1.43.3.10861)
How to check if you're exposed
- Inventory all Plex Media Server instances and record their version numbers from Settings > About
- Flag any instance running a version before 1.43.3.10861
- Review Plex access logs for unusual transcode requests to /video/:/transcode/universal or /player/timeline with suspicious path or protocol parameters
- Check Plex plugin directories for recently modified .so or .dll files that did not come from official updates
How to fix it
- Upgrade Plex Media Server to version 1.43.3.10861 or later
- After upgrade, review and remove any unauthorized files in the Plex plugin and transcode cache directories
- Revoke or rotate any authentication tokens/X-Plex-Tokens that may have been exposed or used in attacks
If you can't patch yet
- Restrict network access to Plex Media Server to trusted users and networks; block external internet access to its ports
- Disable Plex plugin functionality if not required, or restrict which plugins are installed and loaded
- Monitor Plex process execution and file I/O in real time; alert on creation of unexpected .so/.dll files in transcode or plugin directories
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.