Summary
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
- Vendor
- Plex
- Product
- Media Server
- Added to KEV
- Oct 20, 2026
- Remediation due
- Oct 23, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-73
- EPSS
- 1.8% as of Nov 10
In the news
- No Asia-Pacific article names this CVE yet.
In national CERT advisories
ThaiCERT (Thai) · Nov 12, 2026Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References