CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on October 20, 2026; the flaw lets an unauthenticated network attacker call other plugins' functions in Plex Media Server and pass in their own parameters.
What Is It
NVD says Plex Media Server before version 1.43.3.10861 does not correctly neutralize URL values included in searchOne. An attacker can use this to call other plugins' functions and supply their own parameters. CISA lists it as an "Improper Neutralization of Encoded URI Schemes in a Web Page" vulnerability, mapped to CWE-84.
CISA also notes that the flaw can be chained with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656.
Why It Matters
- Active exploitation confirmed: CISA added CVE-2026-96654 to the KEV catalog on 2026-10-20. A CISA SSVC assessment in the NVD record marks exploitation as "active" and the flaw as automatable.
- Low barrier to attack: CVSS 3.1 scores it 6.5 (Medium), with vector
AV:N/AC:L/PR:N/UI:N. That means it works over the network, needs no privileges and needs no user interaction. CVSS 4.0 scores it 6.9 (Medium). - Impact: CVSS rates the confidentiality and integrity impact as low on their own. The chaining with three other CVEs that CISA notes may matter more for defenders.
- Ransomware use: CISA lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Product: Plex Media Server
- Affected versions: All versions before 1.43.3.10861, according to the NVD description and the CNA's affected-version data
- Fixed version: 1.43.3.10861 is listed as unaffected
Plex's security forum post, linked in the KEV entry, covers "v1.43.2 and earlier." The NVD CPE configuration currently lists the version boundary as 1.43.0.10861. Use 1.43.3.10861 as the minimum safe version.
Patch Status
Plex has published a security update and release notes. CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 ("Prioritizing Security Updates Based on Risk") and CISA's Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance. If mitigations are unavailable, stop using the product. Owners should also check each asset's internet exposure.
Federal agencies must remediate by 2026-10-23. All other operators should upgrade to Plex Media Server 1.43.3.10861 or later now, especially on internet-facing instances.
Sources
- CISA KEV Catalog – CVE-2026-96654
- NVD – CVE-2026-96654
- CVE.org Record – CVE-2026-96654
- Plex Forums – Important Security Update for Plex Media Server v1.43.2 and Earlier
- Plex Forums – Plex Media Server Release Notes
- CISA CSAF Advisory VA-26-266-01
- zmain.info – plex2shell
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance