Our automated tracking framework flagged that CISA added CVE-2026-96656 (Plex Media Server) to the Known Exploited Vulnerabilities (KEV) catalog on October 21, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-96656 by October 23, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-96656 |
| Vendor / product | Plex Media Server |
| Vulnerability | Plex Media Server External Control of File Name or Path Vulnerability |
| CVSS base score | 7.2 |
| Added to KEV | October 20, 2026 |
| Days public before listing (NVD → KEV lag) | 27 |
| Federal patch deadline | October 23, 2026 |
| Known ransomware use | No |
How This Compares to Plex’s Track Record
This one was public for 27 days before CISA confirmed exploitation — longer than Plex’s 27-day median, a vulnerability that sat exploitable in the open.
| Plex in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 5 |
| Median lag (public → KEV listing) | 27 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1754 tracked KEV entries is 237 days — Plex’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Plex KEV Additions
The most recent Plex vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-96652 | Media Server | October 20, 2026 | 27 | No |
| CVE-2026-96655 | Media Server | October 20, 2026 | 27 | No |
| CVE-2026-96654 | Media Server | October 20, 2026 | 27 | No |
| CVE-2020-5741 | Media Server | March 10, 2023 | 1036 | No |
What This Means for Defenders
CISA has added CVE-2026-96656, an External Control of File Name or Path vulnerability in Plex Media Server, to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must patch by October 23, 2026. With a CVSS base score of 7.2, this vulnerability requires immediate attention from all organizations using Plex Media Server, especially those exposing instances to the internet. CISA’s confirmation of active exploitation points to a risk for data integrity and system compromise.
This CVE was added to the KEV catalog 27 days after its public disclosure. Exploitation has likely been underway for about a month. Patch Plex Media Server instances before October 23, 2026. If you can’t, restrict access to the server, segment networks, and monitor for unusual activity.
There’s no known ransomware use associated with CVE-2026-96656. However, file and path manipulation vulnerabilities can lead to system compromise or data exfiltration. Prioritize patching Plex Media Server instances to prevent exploitation.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
