Read the docs
TI-2026-63827 Aliases CVE-2026-96654GHSA-3j7c-jr86-m5jq

Plex Media Server URL injection lets attackers call other plugins

Priority CRITICAL 88Exploited in the wildCWE-84Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values in searchOne (CWE-84). A remote, unauthenticated attacker can call other plugins' functions and supply their own parameters. CISA lists the flaw in its Known Exploited Vulnerabilities catalog, added on 2026-10-20.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-20CISA due date 2026-10-23
EPSS 0.01949 80th percentileScored 2026-11-07
Fix Fixed Media Server (Plex): 1.43.3.10861

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PlexMedia Serverbefore 1.43.3.108611.43.3.10861Patch availableCNA
  • Media Server VendorPlex Affected before 1.43.3.10861 Fixed in 1.43.3.10861 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*before 1.43.3.10861VulnerablePlex
  • cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:* Versions before 1.43.3.10861 Vulnerable ·Plex

Remediation

Upgrade Plex Media Server to version 1.43.3.10861 or later. CISA requires U.S. federal agencies to fix this vulnerability by 2026-10-23.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Media Server (Plex) Fixed in 1.43.3.10861

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Plex Media Server 1.43.3.10861

    5 records Highest priority Priority CRITICAL 2 CRITICAL, 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-63829 Arbitrary file write in Plex Media Server enables code executionPriority CRITICAL 96
    • TI-2026-63828 Server-side request forgery in Plex Media ServerPriority HIGH 81
    • TI-2026-63826 Server-side request forgery in Plex Media ServerPriority HIGH 81
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-96654
  2. 2026-10-03 Alias added: GHSA-3j7c-jr86-m5jq
  3. 2026-10-20 Added to CISA KEV
  4. 2026-10-20 CISA SSVC decision points changed
  5. 2026-10-21 CISA SSVC decision points changed
  6. 2026-10-21 Priority changed: LOW → CRITICAL
  7. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 1

  • TI-2026-63829 Arbitrary file write in Plex Media Server enables code execution KEVCVSS 4.0HIGH 8.6
  • TI-2020-04669 Deserialization of untrusted data in Plex Media Server KEVCVSS 3.1HIGH 7.2
  • TI-2026-63828 Server-side request forgery in Plex Media Server KEVCVSS 4.0MEDIUM 5.3
  • TI-2026-63826 Server-side request forgery in Plex Media Server KEVCVSS 4.0MEDIUM 5.3
  • TI-2025-42857 Incorrect authorization in Plex Media Server CVSS 3.1HIGH 8.5
  • TI-2021-13235 Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences