{"metadata": {"vulnerability": "CVE-2026-96656", "count": 36, "kinds": {"milestone": 4, "sighting": 8, "kev": 11, "other": 13}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96656", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-14T18:24:56.053Z", "date_only": false, "value": "2026-09-14T18:24:56.053053Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96656", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-09-14T18:24:56.053Z", "date_only": false, "value": "2026-09-14T18:24:56.053053Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96656", "record": "FKIE_CVE-2026-96656", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T14:42:33.270Z", "date_only": false, "value": "2026-09-23T14:42:33.270Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96656", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:07:10.048Z", "date_only": false, "value": "2026-09-23T16:07:10.048Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96656", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T16:07:10.048Z", "date_only": false, "value": "2026-09-23T16:07:10.048Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96656", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2G2V-9WF5-6M3G", "record": "GHSA-2G2V-9WF5-6M3G", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.840Z", "date_only": false, "value": "2026-09-23T17:17:23.840", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96656", "record": "FKIE_CVE-2026-96656", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2G2V-9WF5-6M3G", "record": "GHSA-2G2V-9WF5-6M3G", "field": "published"}, {"timestamp": "2026-09-30T08:07:07.477Z", "date_only": false, "value": "2026-09-30T08:07:07.477735Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpv6jdiqv27", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "76a0c2f7-b7ba-4078-8d80-d7dbca2b9b4e", "content": "\ud83d\udccc CVE-2026-96656 - Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options... https://www.cyberhub.blog/cves/CVE-2026-96656", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwpv6jdiqv27"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": false, "value": "2026-10-19T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96656", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": false, "value": "2026-10-19T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96656", "record": "FKIE_CVE-2026-96656", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-10-19T11:50:00Z", "date_only": false, "value": "2026-10-19T11:50:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96656", "field": "timestamps.asserted_at", "uuid": "ec1a8e62-2e09-4b05-86df-ac380eb731f8", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:50:00Z", "date_only": false, "value": "2026-10-19T11:50:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96656", "field": "evidence.0.details.added_date", "uuid": "ec1a8e62-2e09-4b05-86df-ac380eb731f8", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:50:00Z", "date_only": false, "value": "2026-10-19T11:50:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96656", "field": "timestamps.first_seen_at", "uuid": "ec1a8e62-2e09-4b05-86df-ac380eb731f8", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:50:00Z", "date_only": false, "value": "2026-10-19T11:50:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96656", "field": "status.status_updated_at", "uuid": "ec1a8e62-2e09-4b05-86df-ac380eb731f8", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T13:25:26.368Z", "date_only": false, "value": "2026-10-19T13:25:26.368666Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "1a2fa2d9-d6ee-457f-bf02-19dbbfd4b325", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.077Z", "date_only": false, "value": "2026-10-19T15:06:51.077017Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "340c70c7-9983-4f4d-9052-776c5670649a", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "timestamps.asserted_at", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96656", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "evidence.0.details.date_added", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "timestamps.first_seen_at", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "status.status_updated_at", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96656", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-20T03:38:06Z", "date_only": false, "value": "2026-10-20T03:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "9ca09d04-06e3-45da-98fd-8c67e72a8739", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T08:38:06Z", "date_only": false, "value": "2026-10-20T08:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "959b605c-87fb-43a8-bd42-03e94ad509ab", "content": "Rilevato lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 e CVE-2026-96656 - gi\u00e0 sanate dal vendor - relative a Plex Media Server. Si evidenzia che risulta disponibile in rete un Proof of Concept (PoC) per lo sfruttamento concatenato di tali vulnerabilit\u00e0.", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T12:00:01Z", "date_only": false, "value": "2026-10-20T12:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96656", "field": "timestamps.recorded_at", "uuid": "ec1a8e62-2e09-4b05-86df-ac380eb731f8", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T12:00:56.341Z", "date_only": false, "value": "2026-10-20T12:00:56.341352Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ec1a8e62-2e09-4b05-86df-ac380eb731f8", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "35711928-9c2f-4f95-adfa-95cf49289549", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ec1a8e62-2e09-4b05-86df-ac380eb731f8"}, {"timestamp": "2026-10-20T12:30:40Z", "date_only": false, "value": "2026-10-20T12:30:40.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/44b72ac1-e095-4aee-ad97-df24053d6b2f", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "6c2930ce-0b45-4e3f-8307-a804a7ff86b0"}, {"timestamp": "2026-10-20T20:00:01Z", "date_only": false, "value": "2026-10-20T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "timestamps.recorded_at", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T20:00:02.359Z", "date_only": false, "value": "2026-10-20T20:00:02.359837Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2a61e1a1-5736-4497-8934-47602681980d", "record": "CVE-2026-96656", "field": "creation_timestamp", "uuid": "145cce3f-81f2-4c19-98e6-b39683f1c9d7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2a61e1a1-5736-4497-8934-47602681980d"}, {"timestamp": "2026-10-20T21:30:35Z", "date_only": false, "value": "2026-10-20T21:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2G2V-9WF5-6M3G", "record": "GHSA-2G2V-9WF5-6M3G", "field": "modified"}, {"timestamp": "2026-10-21T03:56:10.489Z", "date_only": false, "value": "2026-10-21T03:56:10.489Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96656", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T03:56:10.489Z", "date_only": false, "value": "2026-10-21T03:56:10.489Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96656", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T13:09:18.913Z", "date_only": false, "value": "2026-10-21T13:09:18.913", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96656", "record": "FKIE_CVE-2026-96656", "field": "lastModified"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-96656", "field": "evidence.0.details.due_date", "uuid": "2a61e1a1-5736-4497-8934-47602681980d", "status": {"status_reason": "confirmed", "exploited": true}}]}