Actively exploited path traversal vulnerability in Plex Media Server (CVE-2026-96656)

What happened

Organisations running Plex Media Server are currently being targeted by a critical vulnerability, identified as CVE-2026-96656. This vulnerability involves an external control of file name or path weakness (CWE-73), which allows an attacker to write arbitrary files on the server. These files may subsequently be executed when loaded, potentially leading to further exploitation. The vulnerability has been actively exploited in the wild, increasing the risk to affected deployments. It can be chained with other vulnerabilities, such as CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655, if present, which could compound the impact of an attack. It was reported by CISA KEV and is considered severe due to its ability to enable remote code execution without user interaction.

Who is affected

This vulnerability affects organisations operating Plex Media Server, particularly those with exposed internet-facing instances. Any deployment of this product that has not applied mitigations recommended by the vendor is vulnerable to active exploitation. The risk is heightened where the server is accessible from the internet, providing opportunities for malicious actors to leverage this flaw. Given the nature of the attack vector, systems that fail to implement the necessary safeguards may be compromised remotely, leading to potential data loss or further malicious activity.

Recommended actions

1. Apply mitigations in accordance with the instructions provided by the vendor, ensuring compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
2. Review internet exposure of all affected instances and evaluate the feasibility of discontinuing use of the product if mitigations are not available or feasible to implement promptly.
3. Follow applicable BOD 26-04 guidance related to cloud services, adhering to recommended patching timelines and security controls.
4. Stakeholders must assess each asset's exposure to the internet and ensure that appropriate security measures are in place to mitigate the risk of exploitation.