CVE-2026-96654KEV · OVERDUECWE-84

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Medium · published September 23, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 39.3th percentile for exploit probability.

2
days past CISA
deadline
CVSS v3.1
6.5
EPSS
0%
Percentile
39.3
In the wild
Confirmed
What it is

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-84 · Improper Neutralization of Encoded URI Schemes in a Web Page
Published
2026-09-23T21:17Z
KEV added
2026-10-20 · due 2026-10-23
Affected products (1)
ProductVersionsFixed in
plex/media_server< 1.43.3.108611.43.3.10861
References (5)
https://forums.plex.tv/t/plex-media-server/30447/711 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-96654 · 9119a7d8-5eab-497f-8521-727c672e3725https://zmain.info/blog/plex2shell · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 16:06Z
    Plex Media Server URL injection
    cvelistv5