ZeroDayAlert

CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

Plex Media Server Added to KEV 2026-10-20 Federal due 2026-10-23 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Plex Media Server instances are vulnerable to improper handling of encoded URI schemes that could allow an attacker to invoke plugin functions with attacker-controlled parameters. The vulnerability is particularly concerning when chained with related issues in the same product. The record does not specify which versions of Plex Media Server are affected or the conditions required for exploitation.

How to check whether this touches you

  • Inventory all Plex Media Server deployments you operate, including both on-premises and cloud-hosted instances.
  • Confirm whether each instance is reachable from the internet or from untrusted networks; check firewall rules, reverse proxy configurations, and any public DNS records pointing to the server.
  • Retrieve the running version from the Plex web interface (Settings → About) or via the /system/library/preferences endpoint; compare against Plex's published patch advisories to establish whether your build includes the fix.
  • If plugins are enabled on your instance, document which plugins are active and their sources, as the vulnerability centres on cross-plugin function calls.

What to do

  1. Consult Plex's official security advisories and apply any available patches immediately, prioritising instances exposed to untrusted networks.
  2. If a patch is not yet available for your version, restrict network access to Plex Media Server to trusted internal networks only; disable or remove any non-essential plugins.
  3. Enable Plex's request logging and monitor logs for unusual URI patterns, encoded scheme attempts, or cross-plugin function calls that do not correspond to normal user activity.
  4. If your instance is cloud-hosted and no mitigation is available from Plex, prepare a discontinuation plan in accordance with BOD 26-04 guidance and escalate to your security team for approval.
  5. Document the date of patch application and any access restrictions implemented for compliance audits.

If you find you were exposed

Search Plex access logs and proxy logs backdated to at least three months before the CISA advisory date (2026-10-20) for requests containing encoded URI sequences, plugin function calls, or parameter injection attempts. Log retention is the primary constraint; if your logs do not extend beyond thirty days, document that gap explicitly. Engage your security operations team to cross-reference any suspicious activity with your network telemetry and user access patterns.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-96654 is being exploited. It cannot tell you whether Media Server is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →