Critical Analysis: CVE-2026-96656 - Plex Media Server External Control of File Name or Path Vuln... — October 22, 2026

Published 22 Oct 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

Initial Discovery and Context On October 22, 2026, vulnerability researchers published details on CVE-2026-96656, an external control of file name or path vulnerability (CWE-73) affecting Plex Media Server (PMS). The advisory identifies an architectural flaw in how PMS handles user-supplied filesystem parameters across specific media ingestion and transcoding cache endpoints. The vulnerability carries a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated remote access capabilities under standard configurations. The issue affects Plex Media Server versions prior to 1.41.4. In our analysis at AGMP Partners, the attack surface surrounding Plex is broader than most enterprise security teams realize. PMS is frequently treated as consumer-grade software, yet it routinely surfaces during our external perimeter assessments. Network-attached stor