CVE-2026-96654

Medium6.5 Published on Sep 23, 2026

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Early warning: exploitation observed

Exploitation observed since Oct 18, 2026
Not yet in the official CISA catalogue
First attack observed 24 days after disclosure

Source: VulnCheck KEV · Oct 18, 2026

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness type (CWE)CWE-84

Vendorsplex

Affected products

Vendors	Product	Versions
plex	media server	< 1.43.0.10861

Vulnerabilities

Public Plex2Shell Exploit Used to Compromise Exposed Plex Media Servers

Researchers observed public Plex2Shell exploit used against a Plex honeypot to deploy XMRig miner and proxy software, per single-server data.

Oct 19, 202617:30 3 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database