Plex Media Server URL injection (CVE-2026-96654)

What is affected, what to do

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

The vulnerability is being actively exploited; treat it as a priority. Update Plex Media Server to version 1.43.3.10861. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Plex Media Server lt *..1.43.3.10861

Fixed in

• Plex Media Server 1.43.3.10861

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every Plex Media Server instance, including shadow IT such as NAS apps, Docker containers, staff home servers connected via VPN, and digital-signage boxes. Check the running version under Settings → General or via GET /identity.
   • Upgrade to Plex Media Server 1.43.3.10861 or later. This build fixes the missing neutralisation of URL values in the searchOne parameter. The affected-product data is inconsistent (it also lists 1.43.0.10861). Confirm the authoritative build for your platform in the vendor advisory; if unsure, deploy the latest available release.
   • Kill internet exposure where you can't patch today: disable Remote Access in Plex settings, turn off UPnP/NAT-PMP on edge routers, and remove port forwards to the Plex default port TCP 32400. The flaw is reachable over the network without authentication.
   • Remediate the chain together: assess and fix CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656 in the same change. The real risk comes from chaining these, not from this bug alone.
   • Rotate credentials if you suspect compromise: sign out all devices from the Plex account, which invalidates the X-Plex-Token values. Then reset the account password and enable MFA. Rotate any network-share credentials (SMB/NFS) stored on the host as well.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move Plex into a dedicated media/IoT VLAN. Allow inbound TCP 32400 only from defined client subnets. Block outbound traffic from the server to production and OT segments and to management services (RDP 3389, SSH 22, SMB 445). This stops a successful chain from reaching the rest of the network.
   • Reverse proxy / WAF: If remote access is a business requirement, publish Plex only behind a reverse proxy with pre-authentication (VPN, ZTNA or mTLS). Add a WAF rule that rejects requests where searchOne carries encoded URI schemes. Example ModSecurity starting point: SecRule ARGS:searchOne "@rx (?i)(%[0-9a-f]{2}){1,}|[a-z][a-z0-9+.-]*:(//)?" "id:9665401,phase:2,deny,log,t:urlDecodeUni,t:lowercase". Tune it against legitimate searches before enforcing.
   • IPS signature: Write a custom Suricata/Snort rule matching HTTP requests to port 32400 with http.uri; content:"searchOne"; nocase; plus encoded colons or slashes (%3a, %2f, and double-encoded forms such as %253a). Run it in alert mode first, then switch to drop.
   • Endpoint hardening: Run Plex under a dedicated, unprivileged service account, never as root or SYSTEM. Mount media libraries read-only. Remove unused plugins and agents to shrink the surface reachable through plugin function calls.
   • IAM / least privilege: Review shared-library and managed-user grants. Keep the Plex account fully separate from corporate SSO so a stolen Plex token gives an attacker nothing beyond Plex.
3. 03

   Runbook step 3

   Detection rules

   • Plex server log ("Plex Media Server.log", on Linux under /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Logs/): hunt for requests where searchOne contains URL-encoded schemes, e.g. %3A%2F%2F, file%3A, http%3A, javascript%3A, or double-encoded variants. Treat requests from external IPs without a valid token as especially suspicious.
   • Reverse proxy and web access logs (SPL): index=proxy uri_query="*searchOne*" (uri_query="*%3a*" OR uri_query="*%253a*") | stats count by src_ip, uri_query. Watch for bursts from a single source and for scripted user agents.
   • Network telemetry (Zeek): filter http.log on uri containing searchOne with id.resp_p == 32400. Correlate with new outbound connections from the Plex host to unfamiliar destinations, which can indicate a successful chain or a payload download.
   • EDR and Sysmon process ancestry: look for Sysmon EID 1 or EDR events where Plex Media Server.exe, Plex Media Server, or a Plex plugin/script host is the parent of cmd.exe, powershell.exe, sh, bash, curl or wget. Sigma shape: ParentImage|contains: 'Plex' AND Image|endswith: ['\cmd.exe','\powershell.exe'].
   • File integrity: on Linux, set an auditd watch on the Plex plug-in directory (-w <Plex data dir>/Plug-ins -p wa -k plex_plugins); on Windows, use Sysmon EID 11. Unexpected writes to plugins or to Preferences.xml suggest persistence.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Plex Plex Media Server

Weakness classes (CWE)

• CWE-84Improper Neutralization of Encoded URI Schemes in a Web Page

  Variant

  The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

  Entry at MITRE CWE-84

References & sources

• CVE.org (MITRE)urlVulnerability database, Third-party advisory, Vulnerability database
• forums.plex.tvurlRelease notes, Release notes
• raw.githubusercontent.comurlThird-party advisory, Third-party advisory
• zmain.infourlThird-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654government-resource, US government resource
• pwn.watchpwn.watch: Plex2Shell: chained Plex Media Server RCE exploited for minerspwn-watch
• bleepingcomputer.comCISA / BleepingComputer: Plex2Shell actively exploitedpwn-watch
• forums.plex.tvPlex forum: Important Security Updatepwn-watch
• CVE.org (MITRE)CVE-2026-96652pwn-watch
• qnap.comQNAP Security Notice: Plex Media Server Vulnerabilities (Plex2Shell) – Update to 1.43.3.10861 or Later Immediatelypwn-watch
• bleepingcomputer.comQNAP says hackers breaching NAS devices in Plex2Shell attackspwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 21.10.2026NVD analysis modifiedNVD

   Product mapping changed:

   • Plex Media Server (before 1.43.3.10861)

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	changed	OR *cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:* versions up to (excluding) 1.43.0.10861	OR *cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:* versions up to (excluding) 1.43.3.10861
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 21.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T19:46:41.272234Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 20.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-20
   Due Date	added	—	2026-10-20
   Required Action	added	—	2026-10-20
   Vulnerability Name	added	—	2026-10-20

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 20.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
   SSVC assessment	removed	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T16:07:05.456372Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T19:46:41.272234Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 20.10.2026Record modified9119a7d8…

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-09-14T18:22:58.142955Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-96654","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T15:58:41.367540Z"}

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725