CVE-2026-96654: Plex Media Server

What is CVE-2026-96654?

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS6.5 NVD 3.1

SeverityMEDIUM

Exploitation In the wild

EPSS<1% · P13

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWECWE-84

NVD published2026-09-23

NVD last modified2026-09-29

Timeline

2026-09-23Published to the U.S. National Vulnerability Database (NVD)
2026-09-29NVD record last updated
2026-10-20First covered in a defend.network daily briefing

Affected product

Plex Media Server

References

Referenced in our briefings & reports

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits (2026-10-20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.

What is CVE-2026-96654?

Timeline

Affected product

References

Referenced in our briefings & reports

Get Critical CVE Alerts