- Description
- Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
- NVD status
- Analyzed
- Products
- media_server
CVSS 4.0
- Type
- Secondary
- Base score
- 8.6
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.1
- Type
- Secondary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- 9119a7d8-5eab-497f-8521-727c672e3725
- CWE-73
- Hype score
- Not currently trending
🔴 Plex flaws chained for RCE; in-the-wild attacks deploying cryptominers Four CVEs in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) disclosed October 16 are being actively exploited. A researcher chained multiple vulnerabilities to achieve
@NewsTongueX
19 Oct 2026
64 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Plex Media ServerのPlex4Shell脆弱性が悪用された。ハニーポット観測。4件の脆弱性(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)を連鎖させることで無認証で遠隔コード実行可能。 https://t.co/1XTiRaNDX4
@__kokumoto
19 Oct 2026
1088 Impressions
1 Retweet
5 Likes
3 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48C79D09-D197-4165-B027-8BCCE6CD4861",
"versionEndExcluding": "1.43.0.10861",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]