CVE-2026-96656: Plex Media Server File Write Gives Code Execution

Background

Plex Media Server (PMS) is the self-hosted media server behind Plex, run on NAS devices, Docker containers and home servers. Remote playback typically relies on port 32400 being reachable from the internet; Plex says to avoid forwarding it directly unless you need it, and Cord Cutters News cites more than 36,000 unpatched internet-facing instances in a September assessment (single source). PMS runs as a service account. Plex advises treating anything that account can reach, such as mounted shares and credentials stored on the same machine, as potentially exposed.

CVE-2026-96656 is the final step of a four-CVE chain that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 20 October 2026. The other three are CVE-2026-96652, CVE-2026-96654 and CVE-2026-96655. NVD scores those three below 7 (4.3 to 6.9 across CVSS 3.1 and 4.0), so we cover them here as context rather than in separate articles. CISA lists a due date of 23 October 2026 for CVE-2026-96656.

Technical Mechanism

CVE-2026-96656 is classified CWE-73 (external control of file name or path). The CVE record says an admin user can write arbitrary files that may be executed on load. Plex’s advisory describes it as an “arbitrary file write to the Codecs directory through transcoder preferences”. The CVE record adds two details we could not confirm in Plex’s advisory, so treat them as CNA-sourced: the TranscoderH264Options preference is appended verbatim to x264’s option string on every transcode, and at startup all .so files are run without signature, execute-bit or symbol checks.

On its own the flaw needs admin rights, which is why the CVSS vector has a high privileges requirement. The danger is the chain. Researcher write-up zmain.info (an NVD reference, single source) shows the SSRF making the server attach the owner’s X-Plex-Token to a request, and places the TranscoderH264Options write as the last step of the chain, which is why we call this the final step. Plex’s advisory describes the other three as an unauthenticated SSRF in the player timeline endpoint (CVE-2026-96652), access to internal agent functions over the loopback interface (CVE-2026-96654) and disclosure of the server owner’s admin token (CVE-2026-96655). Plex states that together they let an unauthenticated remote attacker run code with the privileges of the PMS process.

The CISA and NVD wording for CVE-2026-96655 (an authenticated SSRF via /video/:/transcode/universal) differs from Plex’s wording (admin token disclosure). Both can be true if SSRF is the route to the token, as the zmain.info write-up shows. Triage by version number, not by description.

CVSS: NVD lists only the CNA’s secondary scores for this CVE: 7.2 High (CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and 8.6 High (CVSS 4.0). We use 7.2 in the frontmatter. The score reflects the admin precondition. In the full chain the practical severity is higher, but that is our judgement, not an official score.

Real-World Exploitation Evidence

CISA lists CVE-2026-96656 in KEV. Plex’s post says the issues are “being actively and widely exploited”, that a public proof of concept was released on 16 October 2026, and that compromised servers have run cryptocurrency mining and proxy software. Cord Cutters News reports a honeypot running an older version was compromised on 17 October and received an XMRig-based miner and a proxy application. It notes that documentation so far covers a single honeypot, while Plex says attacks are widespread. The chain is nicknamed “Plex2Shell” per Cord Cutters, which credits a Reddit post and zmain.info. The honeypot detail is single-source. We did not find a named threat actor as of 22 October 2026 in the sources we checked.

Impact Assessment

Code execution as the PMS service account means anything that account can reach should be treated as potentially exposed, per Plex: mounted shares and credentials stored on the same machine or VM. Plex and Cord Cutters report miners and proxy software on compromised servers; a proxy turns the server address into someone else’s exit node (our inference). Our judgement: exposure is highest where port 32400 is forwarded straight from the internet, and servers sharing a host or NAS with other data carry the most collateral risk.

Affected Versions

Plex Desktop 1.115.0 also ships in the same security release, but the advisory ties the exploited chain to the server.

Remediation Steps

1. Update to 1.43.3.10861 or newer. Confirm the version under Settings, then General, in Plex Web.
2. Reduce exposure. If you do not need remote access, disable it under Settings, then Remote Access, and stop forwarding port 32400.
3. If a server older than 1.43.3.10861 was internet-reachable, assume it may be compromised. Plex recommends rebuilding from a clean install if you find any of its indicators or cannot rule out compromise.
4. At a minimum, empty the Codecs folder and check Preferences.xml for transcoder options you did not set.
5. Sign out all devices from your Plex account and change the password.
6. Review reachable storage. Rotate credentials and check mounted shares the service account can reach.

Plex’s post carries Linux package examples whose version string does not match the 1.43.x numbering, so confirm the right package on the official Downloads page.

Detection Guidance

Plex’s indicators:

• Unfamiliar .so or .dll files in the Plex Codecs folder.
• Unrecognised processes started by PMS, with names such as myawesomeproxy, mylovelyminer or x12345.
• Outbound connections to proxystream[.]st (we saw this only in Plex’s post).
• Sustained high CPU use while nothing is playing.
• Transcoder options in Preferences.xml that you did not set.

Our suggestions (not from Plex): review reverse proxy logs for requests to the player timeline and /video/:/transcode/universal endpoints from unfamiliar addresses, look for PMS requesting its own loopback address, and alert on a media server process connecting to mining pools.

Timeline

References

• Plex: Important Security Update for Plex Media Server v1.43.2 and earlier
• NVD: CVE-2026-96656
• Cord Cutters News: Plex Media Server owners urged to update after in-the-wild exploitation
• zmain.info: Plex2Shell write-up