{"id":"CVE-2026-96654","kind":"vulnerability","aliases":["CVE-2026-96654"],"related":[],"title":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an…","description":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Plex Media Server mishandles encoded URI schemes in a web page, letting an attacker call other plugins' functions with attacker-chosen parameters. The sources say it can be chained with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656, and CISA lists it as actively exploited.","severity":"high","cvss":6.9,"epss":null,"exploited":true,"exploited_at":"2026-10-20T00:00:00+00:00","products":[{"name":"Plex Media Server","fixed":["1.43.3.10861"],"affected":"< 1.43.3.10861","ecosystem":"vendor"},{"name":"Plex Media Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","internet-exposed","other","plex-media-server","poc-public","rce-chain","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed Plex Media Server version against the fixed release (Plex Media Server version string in the Settings or dashboard).","fix":"Upgrade Plex Media Server to 1.43.3.10861 or later.","status":"open","published_at":"2026-09-23T17:17:23+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:39:48+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:39:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Plex Media Server to 1.43.3.10861 or later.","reach":"internet","title":"Plex Media Server: encoded URI flaw lets attackers call plugin functions","impact":"high","summary":"Plex Media Server mishandles encoded URI schemes in a web page, letting an attacker call other plugins' functions with attacker-chosen parameters. The sources say it can be chained with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656, and CISA lists it as actively exploited.","category":"vendor","who_cares":["plex-media-server","self-hosted","internet-exposed"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker calls plugin functions with own parameters, possibly chaining to code execution","analyst_note":"Confirm the exact preconditions (auth, default config) and the chained CVEs' details from the CISA KEV entry and Plex security bulletin.","how_to_check":"Check the installed Plex Media Server version against the fixed release (Plex Media Server version string in the Settings or dashboard).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000547,"input_tokens":3223,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Plex advisory and fixed version for CVE-2026-96654 and check whether it is reachable from the internet; sources list affected and fixed versions as unknown.","search":"'-04':159C,185C,216C '-2026':17A,20A,79B,82B,86B,133C,136C,140C '-96652':80B,134C '-96654':18A,21A '-96655':83B,137C '-96656':87B,141C '1.43.3.10861':5A '26':158C,184C,215C 'accord':148C 'action':144C 'activ':93B 'adher':212C 'allow':15A,113C 'appli':145C 'applic':182C 'asset':206C 'attack':60B,67B,115C 'attacker-chosen':66B 'base':163C 'bod':157C,183C,214C 'call':61B,117C 'chain':42B,76B,130C 'chosen':68B 'cisa':89B,142C,155C,172C 'cloud':188C 'complianc':153C 'contain':98C 'correct':8A 'could':112C 'cve':16A,19A,78B,81B,85B,132C,135C,139C 'discontinu':191C 'encod':51B,103C 'ensur':152C,211C 'evalu':204C 'exploit':28B,94B 'expos':31B 'exposur':209C 'follow':181C 'forens':174C 'function':64B,120C 'guidanc':170C,186C 'guidelin':218C 'host':45B 'improp':100C 'includ':12A 'instruct':151C 'internet':30B,208C 'internet-expos':29B 'let':58B 'list':90B 'media':2A,23A,26A,35B,48B,96C 'mishandl':50B 'mitig':146C,197C 'neutral':9A,101C 'note':169C,180C 'page':57B,109C 'paramet':69B,125C 'patch':217C 'plex':1A,22A,25A,34B,47B,95C 'plex-media-serv':33B 'plugin':63B,119C 'poc':38B 'poc-publ':37B 'priorit':160C 'product':195C 'public':39B 'rce':41B 'rce-chain':40B 'requir':143C,176C 'respons':202C 'risk':165C 'say':72B 'scheme':53B,105C 'searchon':14A 'secur':161C 'see':166C,177C 'self':44B 'self-host':43B 'server':3A,24A,27A,36B,49B,97C 'servic':189C 'sourc':71B 'stakehold':200C 'suppli':122C 'triag':175C 'unavail':199C 'updat':162C 'uri':52B,104C 'url':10A,167C,178C 'use':192C 'valu':11A 'vendor':46B,150C 'vulner':110C,127C 'web':56B,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-23T17:17:23+00:00","kev":{"dateAdded":"2026-10-20","dueDate":"2026-10-23","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":2,"sources":[{"source":"kev","external_id":"CVE-2026-96654","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654","severity":null,"published_at":"2026-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96654:100","url":null,"severity":null,"published_at":"2026-10-23T21:32:50+00:00","modified_at":"2026-10-23T21:32:50+00:00","first_seen_at":"2026-10-23T21:32:50+00:00","fetched_at":"2026-10-23T21:32:50+00:00","note":"Plex forum notice (Oct 19 update) + CVE record + Censys: fixed in PMS 1.43.3.10861 (note 1.43.3.10828 still vulnerable); part of Plex2Shell chain, public PoC Oct 16, in-the-wild exploitation since Oct 17. Severity raised from CVSS 6.5/6.9 medium to high because exploited and chain is unauthenticated RCE. Did not search X/social."},{"source":"nvd","external_id":"CVE-2026-96654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654","severity":null,"published_at":"2026-09-23T17:17:23+00:00","modified_at":"2026-10-21T13:09:37+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1078,"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","title":"Plex: Important Security Update for Plex Media Server v1.43.2 and earlier","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1081,"url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","title":"Censys advisory: Plex Media Server RCE chain","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1082,"url":"https://zmain.info/blog/plex2shell","title":"Plex2Shell write-up (Zach Main)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1084,"url":"https://github.com/code-zm/plex2shell","title":"code-zm/plex2shell exploit code","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1092,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96654","title":"CVE Record CVE-2026-96654","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}