CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Summary
Plex Media Server has a vulnerability (CVE-2026-96654) where improper neutralization of encoded URI schemes in a web page allows attackers to call other plugins' functions with custom parameters. This flaw can be chained with other CVEs, and CISA has issued directives for mitigation.
IFF Assessment
This vulnerability allows an attacker to manipulate system functions, posing a direct threat to the integrity and security of the Plex Media Server and potentially its users' data.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 23, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should prioritize patching or mitigating this vulnerability in Plex Media Server installations immediately, as it can be chained with other exploits. Organizations should follow CISA's BOD 26-04 guidance for risk-based patching and ensure all affected systems are secured, especially those with internet exposure.