CVE-2026-96654
Plex Media Server
What this is
Media Server from Plex does not correctly handle address values passed to it. This lets an attacker call functions in other plugins and choose the values passed to those functions.
How it can harm you
An attacker can reach the flaw over a network without signing in or requiring anyone to interact. They can invoke other plugins' functions with their chosen values, potentially reading or changing some information. The specific information and functions at risk are unknown.
How urgent it is
This vulnerability is already being used in attacks. Update to the fixed release to close the flaw.
Who is affected
Media Server from Plex versions before 1.43.3.10861 are affected.
What to do
Update Media Server from Plex to 1.43.3.10861, the fixed release.
How to check your server
Check the installed version of Media Server and compare it with the affected and fixed versions in the Plex advisory.
Technical details
- CVE
- CVE-2026-96654
- Published
- September 23, 2026
- CWE
- CWE-84
- CVSS
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.5% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.