CVE-2026-96656

Description

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Overview

State: PUBLISHED
Assigner (CNA): cisa-cg
CVSS severity: HIGH
CVSS score: 8.6 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 8.6 / 10 HIGH source: CNA overview
CWE(s): CWE-73
Reserved: 2026-09-23
Published: 2026-09-23 16:07 UTC
Last updated: 2026-09-23 16:46 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96656.json
Linked Threat: CVE-2026-96656 — Plex Media Server arbitrary file write

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 17:17:23 UTC
NVD last modified: 2026-09-23 17:58:26 UTC
NVD CVSS v3.1: 7.2 / 10 HIGH source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.2 / 10
Impact subscore: 5.9 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85370
Assigner: cisa-cg
Published: Sep 23, 2026, 4:07:10 PM
Updated: Sep 23, 2026, 4:46:12 PM
EUVD base score (CVSS 4.0): 8.6 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: Plex
Products: Media Server (0 <1.43.3.10861)
Aliases: GHSA-2g2v-9wf5-6m3g

ENISA description: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
Plex	Media Server	`0` (affected), `1.43.3.10861` (unaffected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

url release-notes
url vdb-entry
url third-party-advisory
url third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://forums.plex.tv/t/plex-media-server/30447/711 9119a7d8-5eab-497f-8521-727c672e3725
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json 9119a7d8-5eab-497f-8521-727c672e3725
https://www.cve.org/CVERecord?id=CVE-2026-96656 9119a7d8-5eab-497f-8521-727c672e3725
https://zmain.info/blog/plex2shell 9119a7d8-5eab-497f-8521-727c672e3725

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege ...

web:arcticwolf.com

Validate Group Policy and registry settings for Defender to ensure real-time protection, automatic remediation , and exclusion policies are secured. Temporary Workarounds Block Vulnerable Apps: Use Microsoft Defender Vulnerability Management to block or warn against execution of affected binaries for systems pending a patch .

2026-09-24 11:08 UTC
Nightmare Eclipse bypasses Microsoft patch with new ... - Cybernews

web:cybernews.com

Microsoft's latest Patch Tuesday addressed 236 Windows bugs, only for the disgruntled researcher Nightmare Eclipse to show up and punch a massive privilege escalation hole. It isn't even new - the Windows Defender exploit bypasses the previous insufficient fix .

2026-09-24 11:08 UTC
Microsoft Confirms RoguePlanet Defender 0-Day, Patch in Development

web:cyberpress.org

Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.

2026-09-24 11:08 UTC
Microsoft Confirms Defender RoguePlanet 0-Day Exploit and Working to ...

web:cybersecuritynews.com

Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.

2026-09-24 11:08 UTC
Defender Zero-Day CVE-2026-50656 Under Active Exploit, No Patch

web:dailysecurityreview.com

Microsoft confirmed CVE - 2026 -50656, a zero-day in the Defender Malware Protection Engine allowing SYSTEM-level privilege escalation, is under active exploitation with no patch currently available.

2026-09-24 11:08 UTC
Microsoft Defender Zero-day Vulnerability (CVE-2026-50656) (RoguePlanet)

web:threatprotect.qualys.com

Microsoft announced the disclosure of a Defender zero-day named RoguePlanet. Tracked as CVE - 2026 -50656, successful exploitation of the vulnerability may allow an attacker to gain SYSTEM-level access.

2026-09-24 11:08 UTC
CVE-2026-50656 ShieldBreak Claims Defender Fix Bypass — Megathread

web:windowsforum.com

ShieldBreak, a newly published proof of concept from the researcher known as Nightmare Eclipse, claims to bypass Microsoft's July fix for the Microsoft Defender privilege-escalation flaw CVE - 2026 -50656, better known as RoguePlanet.

2026-09-24 11:08 UTC
Microsoft Confirms It Is Urgently Working On Patch For ... - LinkedIn

web:www.linkedin.com

Microsoft has confirmed that it is developing a security update to address a newly disclosed zero-day vulnerability in Microsoft Defender, following the public release of exploit code that ...

2026-09-24 11:08 UTC
Defender Zero-Day Patched 29 Days After Public Exploit Exposed Millions ...

web:www.techtimes.com

Windows Defender zero-day CVE - 2026 -50656 — known as RoguePlanet — has been patched by Microsoft 29 days after researcher Nightmare Eclipse published working exploit code granting SYSTEM-level ...

2026-09-24 11:08 UTC
Microsoft-vendetta hacker has a new zero day that gives system ...

web:www.theregister.com

Nightmare Eclipse, the serial zero-day hunter who has an axe to grind with Microsoft, published a new Defender zero-day, ShieldBreak, that apparently bypasses Redmond's RoguePlanet patch ( CVE - 2026 -50656), allowing attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. According to at least one other researcher, the exploit works. "I've ...

2026-09-24 11:08 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-96656.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:35:05.105006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:46:12.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Media Server",
          "vendor": "Plex",
          "versions": [
            {
              "lessThan": "1.43.3.10861",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.43.3.10861"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Zach Main"
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-96656",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-09-14T18:24:56.053053Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:07:10.048Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96656"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "title": "Plex Media Server arbitrary file write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-96656",
    "datePublished": "2026-09-23T16:07:10.048Z",
    "dateReserved": "2026-09-23T14:42:33.270Z",
    "dateUpdated": "2026-09-23T16:46:12.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}