Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656) is being actively exploited, CISA warns
CISA added CVE-2026-96656 (Plex Media Server) to its Known Exploited Vulnerabilities catalog on October 20, 2026, which means there is reliable evidence of exploitation in the wild. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654…
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Security professionals
Affected technology: Media Server
Why it matters
CISA lists this as exploited in the wild. Unpatched Media Server systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for Media Server. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
CISA's required action for CVE-2026-96652: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by November 3, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Government advisory
Related
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)…
CISA lists this as exploited in the wild. Unpatched SiteGuard Server Edition and Media Server systems are exposed to active attacks now.
Apply the vendor's security update for SiteGuard Server Edition and Media Server.
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
There's only so much code: the rise in vulnerability numbers
The September Microsoft Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?
EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.