How severe is CVE-2026-96654?

CVE-2026-96654 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-96654 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-96654?

CVE-2026-96654 affects Plex Media Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-96654?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-96654 published?

CVE-2026-96654 was published on 2026-09-23 and last updated on 2026-09-29.

CVE-2026-96654

CVE-2026-96654 is a medium-severity vulnerability in Plex Media Server with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-84.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 6.9
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-84
Affected product: Plex Media Server
Published: 2026-09-23
Last modified: 2026-09-29

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Frequently asked questions

What is CVE-2026-96654?: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
How severe is CVE-2026-96654?: CVE-2026-96654 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-96654 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-96654?: CVE-2026-96654 affects Plex Media Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-96654?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-96654 published?: CVE-2026-96654 was published on 2026-09-23 and last updated on 2026-09-29.

References

Affected products (1)

cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*

More vulnerabilities in Plex Media Server

CVE-2018-13415 — Critical (CVSS 9.8): In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External…
CVE-2020-5742 — High (CVSS 8.8): Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin…
CVE-2019-19141 — High (CVSS 8.8): The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write…
CVE-2025-69414 — High (CVSS 8.5): Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call…
CVE-2020-5740 — High (CVSS 7.8): Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary…
CVE-2021-33959 — High (CVSS 7.5): Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

All CVEs affecting Plex Media Server →

Other CWE-84 vulnerabilities

CVE-2025-58444 — High (CVSS 8.6): The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported…
CVE-2026-88859 — Medium (CVSS 6.3): A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML…
CVE-2026-67338 — Medium (CVSS 6.1): JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to…
CVE-2024-52890 — Medium (CVSS 6.1): IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to…
CVE-2025-25329 — Medium (CVSS 5.5): An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access…
CVE-2025-25334 — Medium (CVSS 5.5): An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via…

Browse all CWE-84 vulnerabilities →