CVE-2026-96654: Plex Media Server Agent-Function URL Injection (KEV, "Plex2Shell")

CVE-2026-96654 is a URL-neutralization flaw in Plex Media Server's 'searchOne' parameter that lets an attacker call other plugins' internal agent functions with attacker-supplied parameters, and it is the "guard bypass" step that researcher Zach Main's public "Plex2Shell" exploit chain uses to turn three other Plex flaws into unauthenticated remote code execution; CISA added it to KEV on 2026-10-20 after that chain was exploited in the wild.

CVE-2026-96654 is an improper neutralization of encoded URI schemes issue (CWE-84) in Plex Media Server. NVD's description states: "Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters" (NVD).

NVD lists the CVE as "Analyzed" with a Secondary CVSS v3.1 base score of 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, and a CVSS v4.0 score of 6.9 (medium); no NVD Primary score is published, so this is Plex's own CNA-submitted rating, not an NVD-confirmed figure (NVD). Read alone the score suggests a low-impact information-exposure bug, but it understates real risk because, chained with other flaws, it enables full remote code execution.

Plex's own security-update post for Media Server 1.43.3 describes CVE-2026-96654 as "access to internal agent functions over the loopback interface," and groups it with three other CVEs fixed in the same build — an unauthenticated SSRF in the player-timeline endpoint (CVE-2026-96652), disclosure of the server owner's admin token (CVE-2026-96655), and an arbitrary file write via transcoder preferences (CVE-2026-96656), each already covered on this site. Plex states that "when chained, these flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process," that the issues are "being actively and widely exploited," that a public proof of concept was released on 2026-10-16, and that compromised servers have been used to run cryptocurrency miners and proxy software that "routes other people's traffic through the victim's internet connection" (Plex Security Advisory).

Independent researcher Zach Main's "Plex2Shell" write-up names CVE-2026-96654 as stage 3 of a five-stage chain: an unvalidated token-presence check on /player/timeline (stage 1), an SSRF via the companion-protocol subscription mechanism that reaches the loopback-only agent API (stage 2), a broken authentication guard in agentservice.py — where identifier validation "returns from inner(), not from search_one" — that this CVE exploits to call arbitrary plugin functions (stage 3), admin-token theft via DNS-hijacking with sslip.io (stage 4), and code execution by writing a malicious shared object into the Codecs directory through a manipulated transcoder preference (stage 5). Main reported the chain to Plex on 2026-07-27, Plex shipped the fix on 2026-08-03/04, and Main published the full technical write-up and proof-of-concept code on 2026-10-16, after which Shadowserver-tracked exploitation against internet-facing servers began on 2026-10-17 (zmain.info: Plex2Shell).

CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20, with a required-action due date of 2026-10-23, noting it "can be chained with three related CVEs," and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.0195 (80.1st percentile) (FIRST EPSS).

Because this flaw only becomes a full compromise when combined with the other three chained CVEs, Plex Media Server operators should update to 1.43.3.10861 or later regardless of this CVE's standalone medium score, and — given confirmed in-the-wild exploitation since 2026-10-17 — check any server that was internet-reachable before patching for unfamiliar files in the Codecs directory and unexpected cryptomining or proxy processes.

• Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values in 'searchOne', allowing an attacker to call other plugins' functions and supply their own parameters (CWE-84). — NVD
• NVD status is Analyzed; Secondary (Plex CNA) CVSS v3.1 base score is 6.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CVSS v4.0 score 6.9; no NVD Primary score published. — NVD
• Plex describes this CVE as "access to internal agent functions over the loopback interface," groups it with CVE-2026-96652/96655/96656, states the chained flaws let an unauthenticated remote attacker run code as the Plex Media Server process, are being actively and widely exploited, with a public PoC released 2026-10-16 and compromised servers used for cryptomining and traffic-proxying. — Plex Security Advisory
• "Plex2Shell" chain: CVE-2026-96654 is stage 3, a broken authentication guard in agentservice.py that lets the SSRF from stage 2 reach and call arbitrary plugin functions; reported 2026-07-27, fixed 2026-08-03/04, publicly disclosed with PoC on 2026-10-16, exploitation observed from 2026-10-17. — zmain.info: Plex2Shell
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-20, required-action due date 2026-10-23, noted as chainable with three related CVEs, ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.0195 (80.1st percentile) as of 2026-10-28. — FIRST EPSS