CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-10-20
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-10-21
Weakness: CWE-84

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Summary

Plex Media Server before 1.43.3.10861 fails to properly neutralize URL values passed to 'searchOne,' letting an attacker invoke other plugins' functions with attacker-supplied parameters. Rated CVSS 6.5 (medium), it is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so internet-exposed servers are at real risk. Update to 1.43.3.10861 or later, and if patching is not possible, restrict exposure or discontinue use per CISA BOD 26-04 guidance.

لا يقوم Plex Media Server قبل الإصدار 1.43.3.10861 بتحييد قيم URL الممررة إلى 'searchOne' بشكل صحيح، مما يسمح للمهاجم باستدعاء وظائف إضافات أخرى بمعاملات يقدمها بنفسه. التقييم CVSS 6.5 (متوسط)، وهو مدرج في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، لذا فإن الخوادم المكشوفة على الإنترنت معرضة لخطر حقيقي. حدّث إلى الإصدار 1.43.3.10861 أو أحدث، وإذا تعذر الترقيع فقيّد التعرض أو أوقف استخدام المنتج وفق إرشادات CISA BOD 26-04.

Affected products

Plex Media Server: before 1.43.3.10861 — fixed in 1.43.3.10861

How to fix

Upgrade to a fixed version: Plex Media Server 1.43.3.10861. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-96654 or the next vulnerability affects your stack