Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Metrics
CVSS 3.1 7.2/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Plex | Media Server | < 1.43.3.10861 |
References
- https://forums.plex.tv/t/plex-media-server/30447/711Release Notes
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-96656Third Party Advisory, VDB Entry
- https://zmain.info/blog/plex2shellThird Party Advisory
- https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.htmlThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656US Government Resource
Timeline
- Published
- Sep 23, 2026
- Last modified
- Oct 21, 2026
- Added to CISA KEV
- Oct 20, 2026
- NVD status
- Analyzed