Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

What's happening and what to do

An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

2026-10-20Added to CISA's Known Exploited Vulnerabilities catalog.
2026-10-23Federal patch deadline for US agencies.
2026-11-03 21:55First seen here.

Source text

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.