CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026. The vulnerability affects Plex Media Server and is an external control of file name or path flaw that can let an admin user write arbitrary files that may execute when loaded.
The vulnerability can be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96655. The supplied data does not specify a network attack vector or further conditions for exploitation. NVD rates it 8.6 (HIGH). Patch status is unknown; Plex has published security guidance for Media Server v1.43.2 and earlier, so organisations should consult the vendor’s instructions rather than assume a fix is available.
KEV inclusion means CISA has confirmed active exploitation. The data does not confirm whether the vulnerability is used in ransomware campaigns. CISA set a remediation deadline of 23 October 2026.
CISA requires organisations to apply mitigations in accordance with vendor instructions and the guidance in BOD 26-04, Prioritizing Security Updates Based on Risk, and its Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance; discontinue use of the product if mitigations are unavailable. Federal Civilian Executive Branch (FCEB) agencies are directly affected by CISA’s requirements.
Stakeholders should assess each asset’s internet exposure and follow BOD 26-04 patching guidance; all organisations should review their exposure and the vendor’s security instructions.
For full details, see the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96656) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).