CVE-2026-96654: Plex Media Server Vulnerability
Active exploitation confirmed in CISA KEV.
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-20. Federal agencies must patch by 2026-10-23.
TL;DR - CVE-2026-96654 affects Plex Media Server versions before 1.43.3.10861. - CISA lists the vulnerability in its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. - Upgrade immediately and investigate internet-facing systems for credential theft, unauthorized files, suspicious plugin activity, and unexpected processes.
Summary
CVE-2026-96654 is a Plex Media Server vulnerability involving improper neutralization of URL values in the searchOne functionality. According to the NVD description, specially crafted URL values may allow an attacker to call functions exposed by other plugins and supply attacker-controlled parameters.
The issue affects Plex Media Server versions earlier than 1.43.3.10861. CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog on October 20, 2026, with a federal remediation deadline of October 23, 2026.
KEV inclusion means defenders should treat exploitation as confirmed in the wild. The available evidence does not establish that this CVE alone always results in remote code execution. However, public reporting describes it as part of a broader Plex2Shell vulnerability set whose issues may be chained. In the worst case, that broader set may enable credential theft, arbitrary file writes, and code execution with the privileges of the Plex Media Server process.
| Field | Value |
|---|---|
| CVE | CVE-2026-96654 |
| Product | Plex Media Server |
| CVSS base score | 6.5 |
| CVSS vector | Not included in the retrieved NVD record |
| Affected versions | Earlier than 1.43.3.10861 |
| Fixed version | 1.43.3.10861 |
| Patch available | Yes |
| CISA KEV status | Yes |
| Exploitation in the wild | Confirmed by KEV inclusion |
Analyst’s Take: Upgrade every affected server to version 1.43.3.10861 or later. Because KEV confirms exploitation in the wild, previously internet-facing installations also require investigation rather than a version check alone.
For additional context on defensive planning, see our practitioner’s guide to threat modeling.
Root Cause
The root cause is improper neutralization of URL values supplied to the searchOne functionality. Instead of safely restricting or interpreting the requested URL and scheme, Plex Media Server may process attacker-controlled values in a way that permits calls into other plugin functions. The attacker may also provide parameters to those functions.
This behavior creates a trust-boundary problem inside the server. A URL value that should be treated as data can instead influence internal dispatch behavior.
The retrieved NVD material does not provide a complete code-level patch, affected endpoint syntax, or vendor-published exploit precondition. Administrators should therefore avoid assuming that authentication, network location, or a particular plugin configuration reliably prevents exploitation.
The vulnerability is associated with the broader Plex2Shell issue set. Secondary technical reporting describes chaining CVE-2026-96654 with related Plex vulnerabilities, including CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. That chaining reportedly increases the impact beyond the individual URL-handling flaw. However, the available sources do not prove that every installation or exploitation attempt reaches code execution.
Technical Notes
The NVD description identifies the relevant behavior as follows:
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in
searchOne, allowing an attacker to call other plugins’ functions and supply their own parameters.
Investigation should focus on:
- Requests reaching the Plex web service
- Unusual URL schemes or encoded URI values
- Requests involving
searchOne - Unexpected plugin activity
- Child processes launched by the Plex service account
- Unexpected files created by the Plex process
Who’s Exposed
All Plex Media Server installations running a version earlier than 1.43.3.10861 are within the stated affected range. This includes systems directly exposed to the internet, systems published through a reverse proxy, and systems reachable from untrusted internal network segments.
A server does not need to be publicly advertised to be at risk if an attacker can reach its relevant web interface. Internet exposure can arise through:
- Port forwarding
- UPnP
- Reverse proxies
- Remote-access configurations
- VPN misconfiguration
- Cloud relay arrangements
- A compromised device already inside the network
Plex servers may run on NAS appliances, desktops, home servers, media PCs, virtual machines, containers, and small-business infrastructure.
| Product | Affected range | Fixed version |
|---|---|---|
| Plex Media Server | All versions earlier than 1.43.3.10861 | 1.43.3.10861 or later |
Administrators should inventory every installation, including dormant systems, backup hosts, test instances, and containers. If the version cannot be confirmed, treat the installation as potentially affected until package metadata or the administrative interface verifies that it is running 1.43.3.10861 or later.
Severity Breakdown
The reported CVSS base score is 6.5. The retrieved NVD record did not include a CVSS vector string, so the individual CVSS components cannot be independently reported without speculation.
The available data does not reliably establish the attack vector, attack complexity, privileges required, user interaction, or confidentiality, integrity, and availability values used to calculate the score.
This missing vector should not delay remediation. CVSS describes severity under a scoring model, while CISA KEV status supplies a separate and more operationally important signal. A moderate base score combined with confirmed exploitation may represent greater immediate risk than a higher-scoring issue with no known exploitation.
The impact described for the affected Plex vulnerability set includes theft of legitimate user account credentials, arbitrary file writes, and code execution in the worst case. Those outcomes depend on the specific vulnerability chain and execution context. The privileges of the Plex Media Server process, stored credentials, accessible shares, and host hardening controls will influence the final impact.
Technical Notes
Do not reconstruct or publish a guessed CVSS vector from the score alone. Multiple vectors can produce the same base score, and reporting an invented vector could lead to incorrect assumptions about authentication or network reachability.
Record the issue as:
CVSS 6.5; vector unavailable in the retrieved NVD data; CISA KEV-listed and actively exploited.
Exploitation Status
Exploitation in the wild is confirmed for prioritization purposes because CVE-2026-96654 is listed in CISA’s Known Exploited Vulnerabilities catalog.
CISA added the CVE on October 20, 2026, and specified a federal remediation deadline of October 23, 2026. The catalog’s ransomware-campaign field is unknown. “Unknown” means CISA did not identify ransomware campaign use in that field; it does not mean exploitation is unconfirmed.
Public reporting indicates that a proof of concept for the broader Plex2Shell issue set was released on or around October 16, 2026. The retrieved research does not provide a primary PoC repository URL that can be independently validated here. Defenders should therefore state that a public PoC is reported for the broader issue set, while avoiding the stronger claim that a validated standalone PoC for CVE-2026-96654 has been independently confirmed.
The broader Plex2Shell vulnerabilities have reportedly been chained to increase impact, potentially reaching arbitrary code execution. The available evidence does not establish that CVE-2026-96654 alone always provides remote code execution.
Organizations should nevertheless investigate vulnerable or previously exposed servers for:
- Credential theft
- Unauthorized file creation
- Suspicious plugin calls
- Unexpected child processes
- New outbound network connections
- Changes to Plex configuration or plugins
Sources
The primary vulnerability record is the NVD entry for CVE-2026-96654, which identifies Plex Media Server versions before 1.43.3.10861 as affected and describes the improper neutralization of URL values in searchOne.
The CVE.org record provides the corresponding CVE record.
CISA’s Known Exploited Vulnerabilities catalog records the CVE’s addition on October 20, 2026, the October 23 federal remediation deadline, and the unknown ransomware-campaign status.
The CISA CSAF advisory VA-26-266-01 identifies Plex Media Server versions earlier than 1.43.3.10861 as affected and 1.43.3.10861 as fixed.
The NVD-listed Plex forum reference could not be directly verified through the retrieval process because it returned HTTP 403.
The Plex2Shell technical reference is relevant to the broader vulnerability set and reported chaining context. Claims about a public PoC should be treated as secondary reporting unless independently validated through a primary repository or vendor source.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should begin with asset and version discovery. Identify all Plex Media Server processes, packages, containers, reverse-proxy routes, forwarded ports, and remote-access configurations.
Confirm the running version through one or more of the following:
- Plex administrative interface
- Package manager
- Container image metadata
- Process deployment records
- Appliance software inventory
Systems that were internet-facing before patching should be treated as potentially compromised even if current logs show no obvious exploit.
Review Plex and reverse-proxy access logs for:
- Requests containing
searchOne - Encoded URI values
- Unexpected schemes
- Plugin-function names
- Abnormal parameters
- Repeated malformed requests
Because exact exploit syntax is not established in the retrieved sources, avoid relying on one narrow signature. Correlate web requests with Plex process activity, file creation, authentication events, and outbound network connections.
Technical Notes
A generic web-server query can identify requests that deserve manual review:
# Splunk-style example; adjust the sourcetype and field names
index=web OR index=plex
(uri_query="*searchOne*" OR request="*searchOne*")
| eval suspicious_uri=if(
match(lower(_raw), "searchone") AND
match(lower(_raw), "(%3a|%2f|%5c|javascript:|file:|http:|https:)"),
1, 0)
| where suspicious_uri=1
| stats count min(_time) as first_seen max(_time) as last_seen
values(src_ip) as source_ips values(uri_query) as queries
by host, user
A second useful hunt looks for the Plex process creating files or launching unexpected children. On Linux, auditd can be configured for the service executable or service account:
ausearch -ts recent -x Plex\ Media\ Server -i
ausearch -ts recent -m EXECVE,PATH -i | \
grep -Ei 'plex|/tmp/|/var/tmp/|/dev/shm/'
The executable name and audit rules must be adapted to the host. On Windows, review process-creation telemetry for the Plex service account, especially unexpected shells, scripting engines, archive tools, or network utilities.
Across platforms, investigate newly created files in:
- Temporary directories
- Plugin directories
- Media-library paths
- Administrative locations
- Shared storage accessible to the Plex process
Review Plex authentication and account activity for password changes, new sessions, token use from unfamiliar addresses, and access to administrative functions. If credentials may have been exposed, rotate them from a clean device and invalidate sessions where the deployment supports it.
Remediation Steps
Upgrade every affected installation to Plex Media Server 1.43.3.10861 or later.
The fixed version is identified in the CISA CSAF advisory and the NVD record. Do not stop after upgrading one primary server. Repeat the check for secondary, test, backup, containerized, and appliance-based deployments.
For package-managed Linux installations, use the package-management workflow appropriate to the distribution and Plex repository. On Debian-based systems, an example workflow is:
sudo apt-get update
sudo apt-get install --only-upgrade plexmediaserver
sudo systemctl restart plexmediaserver
Confirm the result rather than assuming the command installed the fixed build:
dpkg-query -W -f='${Version}\n' plexmediaserver
systemctl status plexmediaserver --no-pager
The exact package command may differ on RPM-based systems, NAS platforms, Docker deployments, or vendor appliances.
Container operators should pull a current image containing Plex Media Server 1.43.3.10861 or later, recreate the container, and verify the application version from inside the running deployment. Do not use a floating tag as proof of remediation without checking the actual version.
If immediate patching is impossible:
- Remove internet access.
- Disable port forwarding and unnecessary remote access.
- Restrict the service to trusted management networks.
- Place the service behind an authenticated, tightly filtered reverse proxy or VPN.
- Monitor for exploitation attempts and unexpected process activity.
- Schedule the upgrade as the highest-priority remediation task.
These controls reduce risk temporarily but do not replace upgrading. CISA’s required-action language also calls for discontinuing use where mitigations are unavailable.
Technical Notes
A basic firewall restriction can be applied while the upgrade is prepared. Adapt the rule to the actual Plex port and trusted administration subnet:
# Example only: allow Plex management from the trusted subnet
sudo ufw deny 32400/tcp
sudo ufw allow from 192.0.2.0/24 to any port 32400 proto tcp
sudo ufw status verbose
Do not copy this example into production without confirming:
- Listening ports
- IPv4 and IPv6 exposure
- Container networking
- Reverse-proxy routes
- Required client connectivity
- Trusted administration networks
Patching is not sufficient for a previously internet-facing server. Preserve relevant logs, determine whether the vulnerable version was reachable, and perform forensic triage.
Look for:
- Unauthorized account activity
- Credential theft
- Unexpected files
- Plugin changes
- Outbound connections
- Child processes
- Suspicious authentication events
- Access to connected storage
If compromise is suspected, isolate the host, collect volatile and persistent evidence according to incident-response procedures, rotate credentials from a trusted system, and assess connected storage and other systems.
For users whose Plex credentials may have been exposed, a reputable security tool such as Get Bitdefender → may help with post-incident endpoint checks. Use it as a supplementary measure—not as a replacement for patching, credential rotation, or forensic investigation.
Recommended Priority
Organizations should use the following order of operations:
- Identify all Plex Media Server installations.
- Confirm whether each installation is earlier than 1.43.3.10861.
- Remove unnecessary internet exposure.
- Upgrade affected installations immediately.
- Preserve and review logs from previously exposed systems.
- Rotate potentially exposed credentials.
- Investigate suspicious files, processes, plugin activity, and outbound connections.
- Document the remediation and verify the fixed version after deployment.