22 October 2026
Reference: CVE-2026-96656
1. What is being reported?
The Plex Media Server software has a vulnerability that lets an administrator user write files that can be run automatically when the software starts. This happens because certain settings are added directly to the video processing options without proper checks, and the software runs some files without verifying if they are safe.
2. What this means in plain English
If your organisation uses Plex Media Server and an attacker gains admin access, they could make the server run malicious code. This could lead to data loss, system damage, or further attacks on your network.
3. Could this affect a small business?
Small businesses or organisations using Plex Media Server could be affected, especially if the server is accessible from the internet or shared among multiple users. If you do not use Plex Media Server, this vulnerability does not apply to you.
4. What to do now
- Check if you are using Plex Media Server and identify the version installed.
- Contact your IT provider or software supplier to confirm if your version is vulnerable and to get instructions on applying the latest security updates or mitigations.
- If updates or mitigations are not available, consider discontinuing use of Plex Media Server until the issue is resolved.
- Review who has administrator access to the server and limit it to trusted personnel only.
5. Ask your IT provider
Can you confirm if our Plex Media Server is affected by CVE-2026-96656 and what steps we need to take to secure it?
6. Bottom line
If you use Plex Media Server, act now to apply security updates or mitigations to protect your organisation from active attacks.
Information based on CISA KEV, NVD and reputable security reporting.