MSRXCVE-2026-96654
CVE-2026-96654
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS 4.0 · CNA
chance of exploitation in the next 30 days (EPSS; higher than 80% of CVEs)
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Scores
Affected products
- plex media server: < 1.43.3.10861
Weakness: CWE-84
5 references (advisories, patches, write-ups)
- https://forums.plex.tv/t/plex-media-server/30447/711 · Release Notes
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json · Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-96654 · Third Party Advisory, VDB Entry
- https://zmain.info/blog/plex2shell · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.