What is CVE-2026-96654?

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-20. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-96654 — NVD, CVE-2026-96654 — CVE Program record

First, confirm where the vulnerable product is running

CVE-2026-96654 is an improper neutralization of encoded URI schemes in Plex Media Server before 1.43.3.10861, allowing an attacker to invoke other plugins' functions with attacker-controlled parameters via the 'searchOne' parameter. The vulnerability is chainable with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, increasing risk. The CISA KEV entry mandates applying vendor mitigations per BOD 26-04. No fixed version is established by the supplied catalog entry; teams must verify the vendor advisory (forums.plex.tv) for the exact patched release. Cloud deployment support and managed service exposure are not established by sources; do not assume marketplace images, Kubernetes deployments, or appliance package formats. Remediation ownership differs between customer-managed Plex instances and any managed offerings. Always verify the vendor-supported upgrade path for appliances; do not install host agents or alter the base OS without explicit vendor support.

The named vulnerable product is Plex Media Server. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-96654 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify all EC2 instances or on-premises servers running customer-managed Plex Media Server via asset inventory or SSM inventory; do not assume AWS Systems Manager Patch Manager can update this third-party application.
  2. For each customer-managed instance, confirm the vendor-supported upgrade method (Plex in-app update or package download) and apply it; Patch Manager only handles OS and Microsoft applications on Windows.
  3. If Plex runs in a customer-managed container on ECS/EKS/Fargate, verify the vendor-supported container image tag and redeploy; do not assume a managed service is affected without evidence.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Enumerate Azure VMs and Arc-connected machines hosting customer-managed Plex Media Server; Azure Update Manager assesses OS updates, not arbitrary third-party applications.
  2. For each customer-managed deployment, obtain the vendor-supported upgrade procedure and apply it; do not rely on Update Manager for Plex patches.
  3. If Plex runs in a customer-managed container on AKS or Container Apps, confirm the vendor-supported image and redeploy; distinguish this from any managed media service whose exposure is not established.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. List Compute Engine VMs running customer-managed Plex Media Server; VM Manager Patch applies OS updates via the OS Config agent, not vendor appliance or application updates.
  2. For each customer-managed instance, follow the vendor-supported upgrade path (in-app update or package); do not attempt to patch via OS package managers unless the vendor explicitly provides a repository.
  3. If deployed via GKE or Cloud Run (customer-managed), verify the vendor-supported container artifact and roll out a new deployment; do not claim a managed service is affected without evidence.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. Open the Plex Media Server web UI → Settings → General → Version and confirm the displayed version is 1.43.3.10861 or later (per vendor advisory).
  2. Check the Plex server logs (typically in "Logs/Plex Media Server.log") for successful startup and absence of update errors after the upgrade.
  3. Validate that the 'searchOne' endpoint no longer accepts encoded URI schemes by reviewing the vendor release notes or conducting a safe functional test in a non-production environment.

Questions teams ask

What is the exact fixed version for CVE-2026-96654?

The CVE record states 'before 1.43.3.10861'; the supplied catalog entry does not establish a fixed version. Verify the exact patched release in the vendor advisory at forums.plex.tv.

Can I use AWS Systems Manager Patch Manager / Azure Update Manager / GCP VM Manager to patch Plex Media Server?

No. These services manage OS and supported package updates (Microsoft apps on Windows for Patch Manager). Plex is a third-party application; use the vendor-supported upgrade path (in-app update or vendor package).

Is my managed cloud media service (e.g., AWS Elemental, Azure Media Services, Google Cloud Video) affected?

Applicability is not established by the supplied sources. Do not assert affected or unaffected status for another product; consult that service's own security bulletins.

Does applying the vendor patch guarantee no prior compromise?

No. A patch does not prove there was no earlier compromise. Follow CISA's Forensics Triage Requirements for investigation if the server was internet-exposed before patching.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.