CVE-2026-96656

{
  "etk_id": "ETK-2026-2019",
  "cve_id": "CVE-2026-96656",
  "display_id": "CVE-2026-96656",
  "ghsa_id": "GHSA-2g2v-9wf5-6m3g",
  "euvd_id": "EUVD-2026-85370",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file write and code execution in Plex Media Server",
  "summary": "Plex Media Server versions before 1.43.3.10861 permit an administrator to write files that may be loaded by the server and executed. This requires administrative access and can lead to code execution in the Media Server process context.",
  "mitigation": "Upgrade Plex Media Server to version 1.43.3.10861 or later. Restrict administrative access and review server directories for unexpected shared-object files until the upgrade is complete.",
  "vendor": "plex",
  "product": "media_server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.43.3.10861"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.43.3.10861"
      ],
      "package_name": "Media Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.6,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.004,
  "epss_percentile": 0.3235,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 27.803600766666666,
  "t0_at": "2026-09-23T16:07:10.048000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T22:57:00.472619+00:00",
      "days": 25.28461139605324,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:07:10.048000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-18T00:00:00+00:00",
      "days": 25,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:07:10.048000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-96656"
    },
    "public_poc": {
      "at": "2026-10-17T01:44:36+00:00",
      "days": 23.400994814814815,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:07:10.048000+00:00",
      "url": "https://github.com/gmh5225/plex2shell"
    },
    "trigger_signal": {
      "at": "2026-10-18T00:00:00+00:00",
      "days": 24.328355925925926,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:07:10.048000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-96656"
    }
  }
}