EUVD Vulnerability Catalog Actively Exploited (KEV)

EUVD-2026-85370

Severity: HIGH Base Score: 8.6 CVSS Version: 4.0

Vulnerability Description

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): High

▪ User Interaction (UI): None

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): High

▪ Subsequent Confidentiality Impact (SC): None

▪ Subsequent Integrity Impact (SI): None

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor Plex

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

cisa-cg

EPSS Probability

0.4

Known Aliases

CVE-2026-96656 GHSA-2g2v-9wf5-6m3g

Published On

2026-09-23

Last Updated

2026-10-20

Exploited Since

2026-10-20