HIGHCVSS 7.2Actively exploited · CISA KEV since 2026-10-20Vulnerability
CVE-2026-96656
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Properties
- Euvd product
- Media Server
- Vulnerability name
- Plex Media Server External Control of File Name or Path Vulnerability
- First seen
- 2026-10-20T19:58:23+00:00
- Epss score
- 0.00396
- Cvss score
- 7.2
- Last seen
- 2026-10-20T19:58:23+00:00
- Due date
- 2026-10-23
- Euvd assigner
- cisa-cg
- Retrieved at
- 2026-10-21T01:24:51+00:00
- Exploited euvd since
- 2026-10-20T00:00:00+00:00
- Src batch id
- euvd-20261021T003401Z-4c0cc1
- Date added
- 2026-10-20
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85370
- Score
- 7.2
- Euvd base score version
- 4.0
- Fetched at
- 2026-10-21T00:34:02+00:00
- Euvd vendor
- Plex
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-18T14:03:09+00:00
- Euvd base score
- 8.6
Related Entities (3)
AFFECTS_PRODUCT (1)
HAS_WEAKNESS (1)
MENTIONED_IN (1)
Explore deeper with Ninja Signal's threat intelligence graph