CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

searchOne builds a request from a URL value without neutralizing it (CWE-84, encoded URI schemes). An attacker can craft that value so the call lands on another plugin's function, with parameters of their own. CISA's advisory says this needs no privileges. The CVSS vector rates it network-reachable, low complexity, no user interaction, with low confidentiality and integrity impact.

On its own the flaw looks modest: it lets an outsider invoke plugin functions that were not meant to be reachable this way. Its weight comes from the chain described in the researcher write-up, which lists this CVE with three other Plex flaws, among them the /player/timeline request forgery. In that account the attack steps through internal plugin functionality towards an owner-level token and code execution on the host. The write-up links a public proof-of-concept repository.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-20 and did not mark it as used in ransomware. A Plex server reachable from the internet is the main target. A server on a home or office LAN is exposed to anyone on that network.

Affected: Plex Media Server before 1.43.3.10861, per the NVD description and the CISA advisory. The fixed build is 1.43.3.10861. Check the version in the Plex Web app under Settings, then About. The sources document no command-line check. Installs from a NAS app store or a container image may sit on an older build than the latest release, so check each one individually.

Upgrade Plex Media Server to 1.43.3.10861 or later using the built-in updater, the Plex downloads page, or your NAS or container source. The CISA advisory names this build as the fix and covers four other Plex CVEs fixed in the same release.

CISA's required action: apply vendor mitigations in line with BOD 26-04 and CISA's Forensics Triage Requirements, follow the BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. The due date was 2026-10-23, so for US federal agencies it has already passed. The sources name no workaround other than upgrading, so take unpatched servers off the internet until they are updated.

Search server and reverse-proxy logs for requests that call searchOne with encoded or unusual URL values, especially from addresses that are not your clients. Check for plugin functions that ran when no user asked for them, unexpected plugins, new owner-level tokens or authorized devices on the Plex account, and unfamiliar processes or files on the host. CISA's forensics triage requirement applies, so keep logs and a copy of the Plex data directory before upgrading.

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.