Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex — Media Server
- Added to KEV catalog
- 20 October 2026
- Federal remediation due date
- 23 October 2026
- Weakness classification (CWE)
- CWE-84
AI Breakdown
What it is
Plex Media Server versions prior to 1.43.3.10861 contain a flaw where encoded URL values in searchOne are not properly neutralized. This allows an attacker to invoke functions in other plugins and supply their own custom parameters. Furthermore, attackers can chain this issue with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656 to expand the attack.
Why it matters
CISA has added this issue to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild. While direct ransomware campaign use is currently unknown, unauthorized execution of plugin functions creates a significant security risk. Chaining this flaw with other related vulnerabilities can result in deeper system compromise.
Recommended action
Update Plex Media Server to version 1.43.3.10861 or newer in accordance with vendor guidance. IT teams should evaluate internet exposure, apply forensic triage requirements, and follow CISA BOD 26-04 guidelines by October 23, 2026. If patches or mitigations cannot be applied, discontinue use of the product immediately.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96654
NVD Technical Description
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
More Plex Vulnerabilities
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Remote Code Execution Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services