- Medium 6.9
- Known exploited (CISA KEV)
CVE-2026-96654
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Scores
The facts
- Published
- 23 September 2026
- Last changed
- 20 October 2026
- NVD status
- Modified
- Severity
- Medium, CVSS 6.9 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- plex media server
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 20 October 2026.
- EPSS
- 0.2% chance of exploitation activity in the next 30 days (percentile 13).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.