Skip to content
THREATWIRE

CVE

MediumActive Exploitation

CVE-2026-96654

Plex Media Server searchOne URL handling lets callers reach other plugin functions

CVE-2026-96654 is part of the Plex2Shell chain in Plex Media Server before 1.43.3.10861. NVD lists CVSS 3.1 6.5 and CVSS 4.0 6.9. Fixed in 1.43.3.10861. A public repository covers the chain. Not in CISA KEV as of check. One honeypot saw exploitation on 17 October 2026.

By ThreatWire Desk · Published 23 Sept 2026 · Updated 19 Oct 2026

CVSS
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Class
Other
Status
Active Exploitation
KEV
Not in CISA KEV
0-day
No
Vendor
Plex
Products
Plex Media Server
Affected
Plex Media Server before 1.43.3.10861.
Fixed
Plex Media Server 1.43.3.10861 or newer. Plex announced security updates for 1.43.2 and earlier on 1 September 2026.
CWE
CWE-84
Published
23 Sept 2026
Updated
19 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-96654 is improper neutralization of URL values in searchOne. NVD says an attacker can call other plugins' functions and supply their own parameters.

It is the second link in the chain: the loopback pivot into internal plugin functions. It is one of four CVEs in the chain called Plex2Shell. The others are CVE-2026-96652, CVE-2026-96655, CVE-2026-96656. Plex Media Server before 1.43.3.10861 is affected.

NVD lists CVSS 3.1 6.5 and CVSS 4.0 6.9 for this CVE. NVD maps it to CWE-84. The CVE was published on 23 September 2026.

A researcher published a write-up on 16 October 2026 and a repository that covers all four CVEs. ThreatWire has not run it. On 17 October 2026 another researcher reported seeing the published code used against an internet-facing honeypot that ran an older Plex version. That is one honeypot, not a confirmed mass campaign. See the ThreatWire article on the full chain for details.

The CVE is not in the CISA KEV catalog as of 19 October 2026.

What to do: update Plex Media Server to 1.43.3.10861 or newer and do not expose port 32400 to the internet unless you need to.

Sources

Related writing

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-96654