## Overview
CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities (KEV) list on October 20, 2026. This addition signals a federal deadline for remediation. The vulnerability affects Plex Media Server versions prior to 1.43.3.10861. It allows attackers to exploit improperly neutralized URL values in the 'searchOne' function.
## Technical Details
The vulnerability arises from Plex Media Server's failure to properly handle encoded URI schemes in web pages. Attackers can leverage this flaw to invoke functions from other plugins and supply arbitrary parameters. This could lead to unauthorized actions within the application. The vulnerability can also be chained with other related vulnerabilities: CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, amplifying its potential impact.
## Impact
Successful exploitation of CVE-2026-96654 could allow attackers to execute unintended functions within the Plex environment. This could lead to data exposure or manipulation, depending on the capabilities of the plugins involved. The CVSS score of 6.9 indicates a medium severity, but the potential for chaining with other vulnerabilities raises the risk level significantly.
## Mitigation
Defenders should upgrade Plex Media Server to version 1.43.3.10861 or later as soon as possible. Regularly check for updates and apply security patches promptly. Organizations should also review their plugin configurations and monitor for unusual activity that may indicate exploitation attempts.
CSURFACE Threat Sensor