CVE-2026-96654
URL injection in Plex Media Server lets attackers call arbitrary plugin functions.
A URL injection vulnerability exists in Plex Media Server before version 1.43.3.10861. An attacker can exploit the 'searchOne' function to call other plugins' functions with their own parameters. CISA has added the vulnerability to its known exploited list, meaning active exploitation is occurring, and a fixed version is available.
Plex Media Server · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 23 Oct
SeveritymediumCVSS 6.9 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Media Server 1.43 | 1.43.3.10861 |
What to do
- Update Plex Media Server to version 1.43.3.10861 or later. Prioritize patching as CISA reports active exploitation.
What happened
- 20 OctCISA adds CVE-2026-96654 to its known exploited vulnerabilities catalog, noting active exploitation.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-96654 | Plex Media Server URL injection | medium 6.9 | 20 Oct | 1.9% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-96654 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works