Plex Media Server 'searchOne' Plugin Function Injection Vulnerability Advisory (CVE-2026-96654)

Affected Vendors

Plex

Affected Components

Plex Media Server

Published Date

2026-09-23

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All Plex Media Server installations prior to version 1.43.3.10861

Impact

Attackers can manipulate 'searchOne' parameters to invoke internal plugin functions and inject arbitrary parameters, potentially leading to server compromise or unauthorized data access

Mitigation

Immediately update Plex Media Server to version 1.43.3.10861 or later

Affected Products & Version Scope

All versions of Plex Media Server before 1.43.3.10861 are vulnerable. Servers exposed to the public internet are at significantly higher risk.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Immediate Update: Upgrade to Plex Media Server version 1.43.3.10861 or higher via the official Plex update channel.
Access Control: Restrict direct access to port 32400/TCP from the public internet. Utilize a VPN or Zero Trust Network Access (ZTNA) solution for remote access.
Monitoring: Review server logs for suspicious requests targeting the /searchOne endpoint with unusual URL schemes or parameters.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation (CISA KEV) and high EPSS probability, immediate patching to version 1.43.3.10861 is mandatory to prevent unauthorized remote manipulation.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

CVE-2026-96654 is a critical vulnerability involving the improper neutralization of URL values within the 'searchOne' functionality of Plex Media Server (CWE-84). By crafting malicious URL inputs, an attacker can trigger internal API calls to other installed plugins. This allows the execution of restricted functions with attacker-supplied parameters, bypassing intended security boundaries. The vulnerability's inclusion in the CISA KEV catalog and an EPSS score of 0.94 indicate that this flaw is being actively exploited in the wild, making it a high-priority threat for all administrators.

Official Vendor Advisories & References

NVD Original English Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

https://forums.plex.tv/t/plex-media-server/30447/711

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Release Notes

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory

https://www.cve.org/CVERecord?id=CVE-2026-96654

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory, VDB Entry

https://zmain.info/blog/plex2shell

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: