CISA lists Plex plugin-call flaw in KEV (CVE-2026-96654)
Original title: CISA KEV: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability — Plex Media Server (CVE-2026-96654)
Plex Media Server before 1.43.3.10861 can let an attacker invoke other plugins’ functions; agencies have until October 23.
CISA added CVE-2026-96654 for Plex Media Server to the Known Exploited Vulnerabilities catalog. Versions before 1.43.3.10861 do not correctly neutralize URL values in searchOne, so an attacker can call other plugins’ functions and supply parameters. Agencies must apply vendor mitigations under BOD 26-04 or stop using the product. The due date is October 23, 2026, and ransomware use is unknown.
Unconfirmed: CISA lists known ransomware campaign use as Unknown.
- Affected builds are before 1.43.3.10861.
- The flaw is in searchOne URL handling.
- KEV due date is October 23, 2026.
- Ransomware campaign use is Unknown.
Impact: Call other plugins’ functions with attacker parameters
| Product | Affected |
|---|---|
| Plex Media Server | before 1.43.3.10861 |
- 1.Apply vendor mitigations per BOD 26-04.
- 2.Discontinue use if mitigations are unavailable.
- 3.Complete remediation by October 23, 2026.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 6.9 | 2% | KEV | KEV |
From the original article
1 min read at cisa.govPlex Media Server before 1. 43. 3.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.