CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CVSS 6.9 · Medium⚠ Actively exploited (CISA KEV)
6.9
CVSS score
Medium
Severity
Active
CISA KEV
No
Ransomware use
Oct 23, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, with a federal patch deadline of Oct 23, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Details
AffectedPlex · Media Server
WeaknessCWE-84
CVSS base score6.9 (Medium)
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPublishedSep 23, 2026
Added to CISA KEVOct 20, 2026
Federal patch deadlineOct 23, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-96654 being actively exploited?
Yes — CISA lists CVE-2026-96654 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-96654 affect?
CVE-2026-96654 affects Plex · Media Server.
How do I fix CVE-2026-96654?
Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 23, 2026. Then check whether your personal data was exposed in any related breach.