CISA Adds CVE-2026-96656 to KEV List for Plex Media Server Vulnerability

## Overview CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities (KEV) list on October 20, 2026. This vulnerability affects Plex Media Server versions before 1.43.3.10861. It allows an admin user to write arbitrary files that may be executed on load. ## Technical Details The vulnerability arises from the way Plex Media Server handles the `TranscoderH264Options` preference. This setting is appended verbatim to the x264 option string during transcoding. As a result, an attacker with admin access can manipulate this option to execute arbitrary code. At startup, all shared object (.so) files are executed without signature, execute bit, or symbol checks, increasing the risk of exploitation. ## Impact The CVSS score for CVE-2026-96656 is 8.6, indicating a high severity level. Exploitation can lead to unauthorized code execution on the server, potentially allowing attackers to compromise the system. This vulnerability can also be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655 for more extensive attacks. ## Mitigation Defenders should immediately update Plex Media Server to version 1.43.3.10861 or later. Regularly review user permissions to limit admin access and monitor for any unusual activity within the server. Implementing additional security measures, such as network segmentation and intrusion detection systems, can further mitigate risks associated with this vulnerability.