Summary
generated automatically from NVD dataPlex Media Server has an input neutralization flaw (CWE-84) in how it handles URL values included in 'searchOne'. An attacker can use it to call functions belonging to other plugins and supply their own parameters. The issue affects versions before 1.43.3.10861 and carries a CVSS v3.1 score of 6.5 (MEDIUM), with network access, low complexity, no privileges and no user interaction needed, and limited confidentiality and integrity impact. It is listed in the CISA KEV catalog, meaning it is actively exploited.
NVD description
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-20. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-10-23
EPSS · FIRST.org
0.23%probability of exploitation in the next 30 days
Higher than 12% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 23 sept. 2026
- Updated
- 21 oct. 2026
- Status
- Modified
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
Affected products
Weaknesses (CWE)
References (5)
- https://forums.plex.tv/t/plex-media-server/30447/711Release Notes
- https://www.cve.org/CVERecord?id=CVE-2026-96654Third Party AdvisoryVDB Entry
- https://zmain.info/blog/plex2shellThird Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-84
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.