CVE-2026-96656 is an arbitrary file write vulnerability in Plex Media Server prior to 1.43.3.10861 that allows an admin user to write files that are executed on load. It is the final step of the Plex2Shell exploit chain.

Impact

An admin user can change a transcoder setting to write a malicious file into the Plex **Codecs** folder, which the server then runs automatically. On its own, this requires admin access. In the Plex2Shell exploit chain, the admin token stolen in earlier steps lets an unauthenticated attacker reach this step and run code on the device hosting the server. Attackers have used it to install cryptocurrency miners and proxy software. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation:

Update Plex Media Server to 1.43.3.10861 or later. Updating does not remove an existing compromise, so servers that were reachable from the internet before updating should be checked for the signs of compromise listed in Plex's advisory. Look for unfamiliar files in the Plex Codecs folder and transcoder options you did not set in Preferences.xml.