CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Summary: CVE-2026-96656 is an external control of file name or path vulnerability in Plex Media Server that can allow an admin user to write arbitrary files that may be executed on load. CISA lists it as chainable with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655, with a remediation due date of 2026-10-23 and known ransomware campaign use recorded as unknown.
Bottom line: The flaw turns admin access into arbitrary file writes that execute on load, and CISA notes it can be chained with three other CVEs, so a single foothold may not stay a single issue. The 2026-10-23 due date is the clock your patching has to beat.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-96656Plex
- Related
- CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Oct 20, 2026CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Known Exploited Vulnerabilities · Oct 20, 2026CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Oct 20, 2026