{"history":[{"alert":0,"cve":"CVE-2026-96656","id":23539,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.01785, \"percentile\": 0.78621}"},{"alert":0,"cve":"CVE-2026-96656","id":20903,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.01785, \"percentile\": 0.78487}"},{"alert":0,"cve":"CVE-2026-96656","id":18786,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.01785, \"percentile\": 0.7846}"},{"alert":0,"cve":"CVE-2026-96656","id":16852,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.01785, \"percentile\": 0.78451}"},{"alert":0,"cve":"CVE-2026-96656","id":14830,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.01785, \"percentile\": 0.78435}"},{"alert":0,"cve":"CVE-2026-96656","id":12612,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.01785, \"percentile\": 0.784}"},{"alert":0,"cve":"CVE-2026-96656","id":10594,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.01785, \"percentile\": 0.78384}"},{"alert":0,"cve":"CVE-2026-96656","id":8142,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.01785, \"percentile\": 0.78368}"},{"alert":0,"cve":"CVE-2026-96656","id":5918,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.01785, \"percentile\": 0.78328}"},{"alert":0,"cve":"CVE-2026-96656","id":3622,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.01785, \"percentile\": 0.78303}"},{"alert":1,"cve":"CVE-2026-96656","id":1771,"kind":"cna","observed_at":1793665375,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-96656\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-10-19T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-10-20\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-21T03:56:10.489Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-20T00:00:00.000Z\", \"value\": \"CVE-2026-96656 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unknown\", \"product\": \"Media Server\", \"vendor\": \"Plex\", \"versions\": [{\"lessThan\": \"1.43.3.10861\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"1.43.3.10861\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Zach Main\"}], \"datePublic\": \"2026-08-03T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.\"}], \"metrics\": [{\"cvssV4_0\": {\"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"attackVector\": \"NETWORK\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\"}}, {\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2026-96656\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-09-14T18:24:56.053053Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-73\", \"description\": \"CWE-73 External Control of File Name or Path\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-23T16:07:10.048Z\", \"orgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"shortName\": \"cisa-cg\"}, \"references\": [{\"name\": \"url\", \"tags\": [\"release-notes\"], \"url\": \"https://forums.plex.tv/t/plex-media-server/30447/711\"}, {\"name\": \"url\", \"tags\": [\"vdb-entry\"], \"url\": \"https://www.cve.org/CVERecord?id=CVE-2026-96656\"}, {\"name\": \"url\", \"tags\": [\"third-party-advisory\"], \"url\": \"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json\"}, {\"name\": \"url\", \"tags\": [\"third-party-advisory\"], \"url\": \"https://zmain.info/blog/plex2shell\"}], \"title\": \"Plex Media Server arbitrary file write\"}}, \"cveMetadata\": {\"assignerOrgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"assignerShortName\": \"cisa-cg\", \"cveId\": \"CVE-2026-96656\", \"datePublished\": \"2026-09-23T16:07:10.048Z\", \"dateReserved\": \"2026-09-23T14:42:33.270Z\", \"dateUpdated\": \"2026-10-21T03:56:10.489Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-96656","id":14,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-96656\", \"cwes\": [\"CWE-73\"], \"dateAdded\": \"2026-10-20\", \"dueDate\": \"2026-10-23\", \"forensicTriage\": \"Yes\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656\", \"product\": \"Media Server\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.\", \"vendorProject\": \"Plex\", \"vulnerabilityName\": \"Plex Media Server External Control of File Name or Path Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-96656","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-19T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-10-20","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-10-21T03:56:10.489Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"}],"timeline":[{"lang":"en","time":"2026-10-20T00:00:00.000Z","value":"CVE-2026-96656 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Media Server","vendor":"Plex","versions":[{"lessThan":"1.43.3.10861","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"1.43.3.10861"}]}],"credits":[{"lang":"en","value":"Zach Main"}],"datePublic":"2026-08-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks."}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-96656","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-14T18:24:56.053053Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-73","description":"CWE-73 External Control of File Name or Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-23T16:07:10.048Z","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","shortName":"cisa-cg"},"references":[{"name":"url","tags":["release-notes"],"url":"https://forums.plex.tv/t/plex-media-server/30447/711"},{"name":"url","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-96656"},{"name":"url","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"},{"name":"url","tags":["third-party-advisory"],"url":"https://zmain.info/blog/plex2shell"}],"title":"Plex Media Server arbitrary file write"}},"cveMetadata":{"assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","assignerShortName":"cisa-cg","cveId":"CVE-2026-96656","datePublished":"2026-09-23T16:07:10.048Z","dateReserved":"2026-09-23T14:42:33.270Z","dateUpdated":"2026-10-21T03:56:10.489Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-96656","description":"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.","epss":{"date":"2026-11-12","epss":0.01785,"percentile":0.78621},"epss_checked":1794522003,"first_seen":1793665374,"kev":{"cveID":"CVE-2026-96656","cwes":["CWE-73"],"dateAdded":"2026-10-20","dueDate":"2026-10-23","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656","product":"Media Server","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","vendorProject":"Plex","vulnerabilityName":"Plex Media Server External Control of File Name or Path Vulnerability"},"kev_checked":1794522003,"products":"Plex Media Server","references":["https://forums.plex.tv/t/plex-media-server/30447/711","https://www.cve.org/CVERecord?id=CVE-2026-96656","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://zmain.info/blog/plex2shell","https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656"],"score":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","provider":"cisa-cg","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"solutions":"","state":"PUBLISHED","title":"Plex Media Server arbitrary file write","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656","id":14,"publisher":"CISA KEV","title":"Plex Media Server External Control of File Name or Path Vulnerability"},{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655","id":15,"publisher":"CISA KEV","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability"},{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654","id":16,"publisher":"CISA KEV","title":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability"},{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652","id":17,"publisher":"CISA KEV","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability"},{"canonical_url":"https://xakep.ru/2026/11/11/plex2shell-qnap/","id":414,"publisher":"Xakep","title":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Plex2Shell \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 NAS Qnap"},{"canonical_url":"https://cybersecuritynews.com/plex-vulnerabilities-exploited-in-wild/","id":305,"publisher":"Cyber Security News","title":"Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware"},{"canonical_url":"https://securityaffairs.com/202708/cyber-crime/qnap-warns-users-as-plex2shell-flaws-are-used-to-hack-nas-devices.html","id":285,"publisher":"Security Affairs","title":"QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices"}]}