CVE-2026-96654: listed in the CISA KEV catalog

CVE-2026-96654 · CVSS 6.5 MEDIUM · EPSS 2% · KEV 2026-10-20 · patch available

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Is CVE-2026-96654 exploited?

• Listed in the CISA KEV catalog on 2026-10-20.
• Federal remediation due 2026-10-23.
• Past that date by 14 days.
• EPSS puts exploitation in the next 30 days at 2%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Plex · Media Server · >= 0, < 1.43.3.10861

Is there a patch?

Yes. Update to one of these or later:

From Plex's CVE record

What PlainSec published about CVE-2026-96654

• Plex2Shell puts QNAP NAS storage at risk (2026-11-06)
• PHP2Shell draws millions of attempts, but no success observed (2026-10-27)
• Exploitation spans Plex, Siemens, SiteGuard and a separate ClickFix lure (2026-10-21)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-11-06.