CVE-2026-96656

Vendor

Plex

Product

Media Server

CVSS

7.2

EPSS

0.018 (p78)

CISA KEV

added 20 Oct 2026, due 23 Oct 2026 (9d overdue)

Weakness

CWE-73

Exposure class

Collaboration

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 72
   KEV NVD 23 Sep 2026

   Plex Media Server External Control of File Name or Path Vulnerability

   Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652…

   KEV · due 23 Oct 2026 (overdue) CVSS 7.2 Fix available CVE-2026-96656 Plex
2. 52
   CISA alert CISA 11d ago

   CISA Adds Six Known Exploited Vulnerabilities to Catalog

   CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability…

   Exploited CVE-2026-96652CVE-2026-96654CVE-2026-96655+3 more