CVE-2026-96654 Exploited in the wild

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Risk score: 77/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.5%
Published: 23 Sep 2026
Added to CISA's exploited list: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Plex Media Server before 1.43.3.10861 has a vulnerability where it does not correctly neutralize URL values, allowing an attacker to call other plugins' functions and supply their own parameters. An attacker could use this to potentially gain unauthorized access or manipulate data.
Affected: {'product': 'Plex Media Server', 'version': 'before 1.43.3.10861'}
Fix: Upgrade Plex Media Server to 1.43.3.10861 or later.
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Plex Media Server: Red, act today. Plex Media Server before 1.43.3.10861 has a vulnerability that allows an admin user to write arbitrary files that may be executed on load. An attacker could exploit this to gain elevated privileges, read, write, or modify sensitive data, or execute arbitrary code.

The flaws

CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVSS 6.5 · EPSS 0% · exploited)
CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability (CVSS 7.2 · EPSS 1% · exploited)
CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS 4.3 · EPSS 0% · exploited)
CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS 4.3 · EPSS 0% · exploited)

The fix

Upgrade Plex Media Server: 1.43.3.10861 or later on your release line

Who is exposed: {'product': 'Plex Media Server', 'version': 'before 1.43.3.10861'}

Where it stands

Exploited in the wild
On CISA's exploited list since 20 Oct
US federal deadline 23 Oct
1 outlet covering it

How it unfolded

20 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
20 Oct, CISA advisories (US) (official): CISA Adds Six Known Exploited Vulnerabilities to Catalog
21 Oct, The Hacker News (press): CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
23 Oct, Deadline (official): US federal agencies must have patched

Why it is Amber

CVSS 6.5 medium
Exploited in the wild (CISA KEV)
Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

CISA Adds Six Known Exploited Vulnerabilities to Catalog

References

Original description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Last activity 20 Oct 2026. Patch Forecast updates every hour.