Plex Media Server Arbitrary File Write and SSRF Flaws Trigger Oct 23 Federal Mitigation Deadline
Four vulnerabilities in Plex Media Server, including arbitrary file writes, were added to the federal Known Exploited Vulnerabilities catalog on October 20, 2026.
Key points
- CVE-2026-96656 allows admin users to write arbitrary files that may execute on load.
- Three additional flaws enable server-side request forgery and improper URI neutralization.
- Federal agencies must mitigate these issues by October 23, 2026, or discontinue product use.
The Cybersecurity and Infrastructure Security Agency added four vulnerabilities in Plex Media Server to its Known Exploited Vulnerabilities catalog on October 20, 2026. These flaws include a high-severity issue that permits administrative users to write arbitrary files to disk. Attackers can chain this capability with three other defects to force the server to make unauthorized network requests or invoke plugin functions.
The risk
CVE-2026-96656 carries a CVSS score of 8.6, classifying it as a high-severity vulnerability. According to the National Vulnerability Database, the flaw exists in Plex Media Server versions prior to 1.43.3.10861. The vulnerability stems from how the server handles the TranscoderH264Options preference, appending it verbatim to x264's option string during every transcode operation. At startup, the server runs all .so files without verifying signatures, execute bits, or symbols.
Who is exposed
Administrative users of Plex Media Server are directly exposed to the arbitrary file write vulnerability. The other three flaws affect authenticated users or anyone possessing a valid X-Plex-Token value. CVE-2026-96655 and CVE-2026-96652 are both rated medium severity with CVSS scores of 5.3. CVE-2026-96654, involving improper neutralization of encoded URI schemes, has a CVSS score of 6.9. All four issues can be chained together to amplify the impact of an attack.
Cost and compliance
Federal agencies face a mitigation deadline of October 23, 2026, for CVE-2026-96656 and CVE-2026-96654. The deadline for the two SSRF flaws, CVE-2026-96652 and CVE-2026-96655, is November 3, 2026. CISA requires stakeholders to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable. This aligns with BOD 26-04 guidance on prioritizing security updates based on risk.
What to watch
Security teams should verify that their Plex Media Server installations are running version 1.43.3.10861 or later. If the vendor has not provided an update, organizations must implement compensating controls immediately. Monitor for unusual outbound traffic from media servers, as SSRF flaws can force the server to POST data to attacker-controlled destinations.
Signals worth monitoring
Teams usually detect this type of activity by reviewing web server access logs for anomalous requests to the '/video/:/transcode/universal' or '/player/timeline' endpoints. Check whether the server is initiating unexpected outbound connections to internal IP ranges or external domains not associated with media transcoding. Look for new executable files appearing in temporary directories during startup. Containment moves typically involve restricting network access for the media server process and revoking compromised administrative credentials.
Background: Compensating controls
Compensating controls are alternative security measures used when the recommended safeguard cannot be applied. They must provide equivalent protection to the original control. These measures allow organizations to maintain security posture and compliance despite technical or operational constraints that prevent standard implementation.
Read the full guide: Compensating Controls: How to Secure Systems When Primary Defenses Fail
What to do and how to stay safe: Plex
- Audit all Plex Media Server installations to confirm they are running version 1.43.3.10861 or newer.
- Restrict network access for media servers to prevent unauthorized outbound requests.
- Review administrative accounts for signs of compromise and rotate credentials if necessary.
- Monitor system logs for unexpected file creation or execution during server startup.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the arbitrary file write vulnerability?
CVE-2026-96656 has a CVSS score of 8.6, which is classified as high severity.
Can these vulnerabilities be used together?
Yes, the four vulnerabilities can be chained to allow attackers to write files and force network requests.
What is the federal mitigation deadline for the SSRF flaws?
The federal mitigation deadline for CVE-2026-96652 and CVE-2026-96655 is November 3, 2026.
