Analyzing CVE-2026-96654: Plugin Function Invocation in Plex Media Server

An improper neutralization flaw in Plex Media Server, tracked as CVE-2026-96654, allows remote, unauthenticated attackers to invoke internal plugin functions with user-supplied parameters. By submitting crafted requests containing encoded URI schemes, an attacker can bypass standard routing controls and reach plugin endpoints that were not intended to be exposed directly to incoming HTTP traffic.

The Mechanics of CVE-2026-96654

Plex Media Server relies on an internal HTTP request router to handle communication between the web frontend, local agents, and installed plugins. Under the hood, this vulnerability stems from improper neutralization of encoded URI schemes (CWE-84). When incoming URL paths contain percent-encoded characters or non-standard scheme delimiters, the web interface fails to sanitize them prior to handler dispatch.

Because the URI handler decodes parameters late in the request processing lifecycle, an unauthenticated attacker can trick the server into treating an arbitrary HTTP request as an internal IPC call. This allows the attacker to specify targeted plugin entry points and inject custom arguments into internal handler functions.

Exploitation and Exploit Chaining

The flaw carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Network reachability without authentication or user interaction makes this an attractive entry vector for automated scanning scripts targeting self-hosted media instances on port 32400.

While the isolated EPSS probability measures at 0.23% (12.6th percentile), evaluating this bug in isolation underestimates its severity. CVE-2026-96654 serves as a critical component in a larger exploit chain alongside CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. By combining URI scheme manipulation with sibling vulnerabilities in parameter parsing and file management, an attacker can transition from arbitrary function invocation to local file inclusion, privilege escalation, or unauthenticated remote execution on the host operating system.

Remediation and Recommended Actions

Administrators should update Plex Media Server to version 1.43.0.10861 or later to resolve the improperly neutralized scheme handling and close the entire vulnerability chain.

For enterprise environments or systems covered under CISA BOD 26-04 guidelines, remediation must be completed prior to the October 23, 2026 deadline. If immediate patching is not feasible for internet-exposed instances, restrict access to the server by disabling “Remote Access” within the Plex server settings or placing the management port behind a secure VPN or perimeter firewall.