Improper Neutralization of Encoded URI Schemes Vulnerability in Plex Media Server
CISA has issued an alert regarding an actively exploited improper neutralization of encoded URI schemes vulnerability (CVE-2026-96654) in Plex Media Server. This flaw allows an attacker to call functions of other plugins and supply their own parameters.
Summary: CISA has issued an alert regarding an actively exploited improper neutralization of encoded URI schemes vulnerability (CVE-2026-96654) in Plex Media Server. This flaw allows an attacker to call functions of other plugins and supply their own parameters.
A critical security vulnerability (CVE-2026-96654) stemming from improper neutralization of encoded URI schemes in a web page has been identified in Plex Media Server. This flaw is listed in the CISA KEV catalog and is actively being exploited, potentially leading to attacks via Plex’s plugin architecture.
This vulnerability arises because Plex does not perform sufficient validation when processing URI schemes. An attacker, using specially crafted encoded URIs, can call functions of other Plex plugins and supply their own parameters to these functions. This creates the potential to abuse normally inaccessible or restricted functionalities of plugins.
In live systems, exploiting this vulnerability could lead to unauthorized actions on the Plex Media Server. An attacker might perform file system operations through plugins, access sensitive information, or combine it with other system vulnerabilities to create a broader attack vector. The fact that this vulnerability can be chained with other Plex flaws (CVE-2026-96652, CVE-2026-96655, CVE-2026-96656) increases the risk level.
Plex Media Server users must immediately apply vendor-released updates and review the security of their Plex plugins. Removing untrusted or unnecessary plugins will help reduce the attack surface.
🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar