CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Summary
Plex Media Server has an external control of file name or path vulnerability that allows an admin user to write arbitrary files for execution upon loading. This issue can be combined with other vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655) to potentially lead to further exploitation.
IFF Assessment
This vulnerability allows for arbitrary file writes and potential execution, which is a significant risk for defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 23, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability in Plex Media Server allows for arbitrary file writes, which could be exploited to gain unauthorized access or execute malicious code. Defenders should prioritize patching and implementing vendor-provided mitigations to protect their systems. Awareness of chained exploits is also crucial for comprehensive security.