Search: CVE-2026-96654

CVE-2026-96654 is a vulnerability in Plex Media Server versions before 1.43.3.10861 where improper neutralization of encoded URI schemes in the 'searchOne' parameter allows attackers to invoke other plugins' functions with arbitrary parameters. This flaw can be exploited remotely without authentication and has been confirmed exploited in the wild. The issue is fixed in version 1.43.3.10861.

Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.