IT SBIT Services
Schneeberger
DEEN
CVE tracker

Plex Media Server: Arbitrary file write leading to code execution

CVE-2026-96656High 8.6Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 20 Oct 2026
Deadline for US federal agencies: 23 Oct 2026

Summary

Plex Media Server before 1.43.3.10861 lets a user with administrator rights write arbitrary files through the TranscoderH264Options preference, which is passed unchecked to x264 on every transcode. At startup the server loads all .so files without signature, execute-bit or symbol checks, so a planted file can be executed. The flaw is known to be exploited in the wild as part of the Plex2Shell chain, and public proof-of-concept code exists.

Affected

  • Plex Media Server before 1.43.3.10861

Fixed in

  • Plex Media Server 1.43.3.10861 and later

Workaround

  • No vendor-sanctioned workaround for unpatched systems is known.
  • Unvalidated third-party advice: review TranscoderH264Options and reset it to the default if it was changed, restrict write access of the Plex process to the plugin and codec directories, and monitor for new .so files.

Exploitation

  • Known exploited: listed in the CISA KEV catalog (added October 20, 2026; some sources state October 21).
  • Public proof-of-concept code is available.
  • Observed activity includes cryptomining payloads against honeypots.
  • This flaw requires an administrator account. Real-world attacks use it as part of a chain with other Plex flaws that can be started without a login.

Our recommendation

  • Upgrade Plex Media Server to 1.43.3.10861 or later immediately.
  • Check whether any Plex server was reachable from the internet before the fix. Treat such servers as possibly compromised and rebuild them from a clean installation instead of reusing the old data directory.
  • Review the TranscoderH264Options preference, the Codecs folder for unexpected .so or .dll files, and the list of administrator accounts.
  • Remove direct internet exposure of Plex servers, use VPN access, and monitor for unknown Plex child processes and unexplained high CPU usage.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:41.

Original description (NVD)

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed