Vulnerability Intelligence Report
Plex Media Server URL injection
CVE-2026-96654
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
CISA KEV
SSVC: Active Exploitation
Automatable
CVSS Base Score
6.9
MEDIUM
EPSS Probability:0.23%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-84 ↗CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Plex | Media Server | 0 < 1.43.3.10861 (affected), 1.43.3.10861 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · CERT · USA |
| Reserved | 2026-09-23T14:42:18 |
| Published | 2026-09-23T16:06:35 |
| Patch Date | 2026-08-03 |
| Last Updated | 2026-10-20T19:58:24 |
Community Chatter & Buzz