Plex Media Server flaw CVE-2026-96654 exploited in the wild

What the flaw is and who it affectsCVE-2026-96654 is a vulnerability in Plex Media Server, catalogued by NIST's National Vulnerability Database under...

What the flaw is and who it affects

CVE-2026-96654 is a vulnerability in Plex Media Server, catalogued by NIST's National Vulnerability Database under CWE-84, improper neutralisation of encoded URI schemes in a web page. In plain terms, the server does not correctly neutralise URL values passed through the searchOne parameter, which lets an attacker call functions belonging to other plugins and supply their own parameters.

According to the NVD, every Plex Media Server release before 1.43.3.10861 is affected. The flaw was published on 23 September 2026 and carries a CVSS 4.0 score of 6.9 (MEDIUM). That score is easy to underestimate: the attack vector is network-based, needs no privileges and no user interaction, and the impact is low on confidentiality and integrity. A medium rating describes the isolated flaw, not the risk once it is chained.

And chaining is exactly the point. CISA notes that CVE-2026-96654 can be combined with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656. Any business in Barcelona, Lleida, Tarragona or Girona running a Plex server on a NAS, an office machine or a VPS — often as a side project nobody formally owns — should treat this as a live issue.

Why it is urgent: already exploited, with a deadline

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, which means it has been observed in real attacks. The agency gave US federal agencies until 23 October 2026 to remediate — three days.

The required action is to apply mitigations in line with the vendor's instructions, following BOD 26-04 guidance on risk-based security updates and the forensics triage requirements. CISA also asks asset owners to assess each system's internet exposure and, where no mitigation exists, to stop using the product. There is no record of this vulnerability being used in ransomware campaigns so far, but that detail should not slow anyone down: KEV listing alone justifies immediate action.

What to do today

Inventory first. Find every Plex Media Server instance in the organisation, including the ones installed by an employee on a workstation or a personal NAS connected to the corporate network.
Check the version. Anything below 1.43.3.10861 is in scope. Confirm the exact build rather than trusting an auto-update that may have failed silently.
Update. Apply the release indicated in the vendor's advisory and release notes. If you cannot update immediately, apply the mitigations the vendor specifies — do not improvise your own workaround.
Look for signs of intrusion. Because the flaw allows calling other plugins' functions with attacker-supplied parameters, review logs for unexpected plugin calls, unusual searchOne requests and outbound connections you cannot explain. CISA's forensics triage guidance is a sensible baseline.
Reduce exposure. A media server rarely needs to be reachable from the open internet. Close published ports, restrict access to a VPN or internal network, and segment the host from systems holding customer or business data.

Given the chaining potential, patching only one of the four CVEs leaves the door ajar. Treat CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656 as part of the same job.

How a cybersecurity team such as ALMC's can help

Most SMEs and online shops we work with in Catalonia do not have a dedicated security department, and shadow IT like a media server is precisely what slips through. A security audit and pentest map what is actually exposed, including services nobody documented, and confirm whether a given build is vulnerable before anyone spends a weekend on it.

Server hardening and continuous monitoring then keep that surface small: unnecessary services disabled, access restricted, and alerts configured so an unexpected plugin call is noticed rather than discovered months later. For businesses running WordPress, PrestaShop or Joomla alongside internal tools, regular patching and maintenance close the same gap on the web side, and if a site has already been compromised, incident response and cleanup get it back to a known-good state. The goal is simple: find and close the hole before someone else does.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.