Fixed in Plex Media Server 1.43.3.10861.
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2026-96656 KEV | CWE-73 External Control of File Name or Path | 7.2 High |
Plex Media Server arbitrary file write Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. CISA SSVC — Exploitation: None · Automatable: No · Impact: Total Vendor fix: Fixed in 1.43.3.10861. Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-96651 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6.5 Medium |
Plex Media Server path traversal Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 1.43.3.10861. Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-96654 KEV | CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page | 6.5 Medium |
Plex Media Server URL injection Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 1.43.3.10861. Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-96652 KEV | CWE-918 Server-Side Request Forgery (SSRF) | 4.3 Medium |
Plex Media Server SSRF Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 1.43.3.10861. Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-96655 KEV | CWE-918 Server-Side Request Forgery (SSRF) | 4.3 Medium |
Plex Media Server arbitrary-host SSRF Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 1.43.3.10861. Affected, fixed & timelineAffected:
Fixed in:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
| Date | Source | Article |
|---|---|---|
| 2026-10-21 | The Hacker News | CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws CVE-2026-96652 |
Articles from the monitored vendor research blogs and security news feeds that reference a CVE cited in this publication, or name the campaign it covers. Coverage begins when feed monitoring started; earlier articles are not indexed.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2026-96656 | 8.6 High | Plex Media Server Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be … |
| CVE-2026-96654 | 6.9 Medium | Plex Media Server Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other p… |
| CVE-2026-96651 | 6.5 Medium | Plex Media Server Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/… |
| CVE-2026-96652 | 4.3 Medium | Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a… |
| CVE-2026-96655 | 4.3 Medium | Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.