{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-96656",
  "revision": 1,
  "title": "Plex Media Server — Admin Arbitrary File Write",
  "summary": "Plex Media Server before 1.43.3.10861 lets an admin user write arbitrary files through the TranscoderH264Options preference, and .so files then run at startup without signature checks. It can be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96655.",
  "source_type": "cve",
  "severity": "high",
  "cvss": {
    "score": 8.6,
    "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
    "version": "4.0"
  },
  "epss": 0.01785,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2026-10-20",
    "kev_due": "2026-10-23",
    "prerequisites": "An admin account on the Plex Media Server, which the chained flaws may help an attacker reach."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "1.43.3.10861"
    ]
  },
  "kill_chain": "execution",
  "recommended_action": "Update Plex Media Server to 1.43.3.10861 or later.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-96656",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "writeup",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
    },
    {
      "type": "writeup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96656"
    },
    {
      "type": "writeup",
      "url": "https://zmain.info/blog/plex2shell"
    }
  ],
  "published_at": "2026-09-23T17:17:23.840Z",
  "issued_at": "2026-11-05T07:48:47.009Z",
  "tags": [
    "plex",
    "file-write"
  ]
}