External Control of File Name or Path Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 20 Oct 2026.
1.8%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-96656. Nothing runs until you send it.
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all.so files are run without signature, execute bit, or symbol checks.
You are affected if
The fix