CVE-2026-96654 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-23

Added to CISA KEV: 2026-10-20 27 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Update Plex Media Server to version 1.43.3.10861 or later. Active exploitation in the wild has been confirmed with weaponized exploit chains leading to RCE. This should be treated as an emergency patch.
INCIDENT RESPONSE: If your Plex instance was internet-facing prior to patching, assume potential compromise. Audit system logs (particularly Plex logs at the default log path and OS-level auth logs) for anomalous plugin function calls, unexpected outbound connections, new user accounts, or scheduled task/cron modifications indicative of miner or backdoor installation.
NETWORK RESTRICTION: If immediate patching is not possible, block inbound access to TCP port 32400 from the public internet via firewall rules. Enable Plex relay-only mode or restrict access to trusted IP ranges. Place the server behind a VPN for remote access.
INDICATORS OF COMPROMISE: Check for unauthorized processes (crypto miners often appear as disguised processes consuming high CPU), unexpected cron jobs, new SSH authorized_keys entries, unusual outbound network connections to mining pools or C2 infrastructure, and Plex plugin directory modifications.
THREAT HUNTING: Search for HTTP requests to the Plex API containing URL-encoded schemes in the 'searchOne' parameter in web/access logs. Look for exploitation attempts even if you believe your instance is unpatched but not yet compromised.
LONGER TERM: Evaluate whether Plex Media Server truly requires direct internet exposure. Consider migrating remote access to a VPN-only model, using Plex's relay feature exclusively, or placing the server behind a reverse proxy with WAF capabilities.
PATCH PRIORITY: CRITICAL for internet-facing deployments. HIGH for LAN-only deployments (lateral movement risk if network is breached). Apply within 24-48 hours for exposed instances.

🔍 Web Intelligence (Kagi · 2026-10-20)

Summary

CVE-2026-96654 is an input-validation vulnerability (CWE-84) affecting Plex Media Server that occurs because the application fails to properly neutralize URL values supplied in the `searchOne` parameter. This flaw is significant because it allows attackers to invoke arbitrary plugin functions and pass custom parameters, which can be chained with other related vulnerabilities (collectively known as the "Plex2Shell" exploit chain) to achieve remote code execution and unauthorized access to administrative tokens.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, with reports of threat actors weaponizing the "Plex2Shell" exploit chain (including CVE-2026-96654) to compromise exposed servers shortly after public disclosure ^[1].
Threat Campaigns: Exploits are being used to install malicious payloads, including crypto miners and unauthorized Linux backdoors ^[3].
Availability: Public proof-of-concept exploit chains have been identified and weaponized in real-world attacks ^[1].
Prerequisites: The vulnerability can be exploited by an unauthenticated remote attacker, requiring network access to the target server; it does not require prior user interaction ^[2].

Affected Products & Patches

Affected Versions: Plex Media Server versions prior to 1.43.3.10861 are vulnerable ^[4].
Patch Availability: The issue was addressed by the vendor; users should update their server installations to version 1.43.3.10861 or later to remediate the vulnerability.
Mitigations: For instances where immediate patching is not possible, internet-facing exposure of the Plex Media Server should be restricted using firewalls or VPNs to prevent unauthorized remote access.

Impact

Successful Exploitation: Access allows an attacker to call internal plugin functions, inject custom parameters, and potentially obtain the owner's administrative token ^[3].
Execution Privileges: When chained with related vulnerabilities, the exploit grants the ability to run arbitrary code with the full privileges of the Plex service process ^[1].
Business/System Risk: Internet-facing deployments are at high risk of complete system compromise, data exfiltration, or deployment of persistent malware (e.g., miners and backdoors) due to the ease of unauthenticated remote access ^[2].

Sources

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After ...
Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. The code runs with the same privileges as the Plex service. The issues were reported to Plex on July 27, and the company confi…
Plex2Shell Exploit Chain (CVE-2026-96652, CVE-2026-96654, CVE-2026 ...
The vulnerabilities are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These flaws allow an unauthenticated remote attacker to run code with the same privileges as the Plex service. The vulnerabilities were reported to Plex on July 27, and the company confirmed them a…
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux ...
CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token.
CVE-2026-96654 - Vulnerability Details - OpenCVE
Plex Media Server before version 1.43.3.10861 fails to neutralize URL values supplied in the 'searchOne' parameter, which enables an attacker to invoke arbitrary plugin functions and pass custom parameters. This flaw is a classic input‑validation weakness (CWE‑84) that can lead to unauthorized execu…

🔴 CVE-2026-96654