CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026. The flaw affects Plex Media Server and could let an attacker call functions belonging to other plugins and supply their own parameters.
The vulnerability, named “Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability”, involves improper handling of encoded URI schemes in a web page. The supplied data does not specify further details about the attack vector or the access required. The flaw has a CVSS score of 6.9, rated Medium, and can be chained with CVE-2026-96652, CVE-2026-96655 and CVE-2026-96656. Patch status is unknown; Plex’s security update notice is available, but the provided data does not confirm whether a patch is available.
KEV inclusion indicates that CISA has confirmed active exploitation. The available information does not establish whether attackers have used the flaw in ransomware campaigns. CISA’s remediation deadline is 23 October 2026.
CISA requires affected Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance, including its Forensics Triage Requirements. If mitigations are unavailable, agencies must follow the applicable guidance for cloud services or discontinue use of the product. Stakeholders must assess each asset’s internet exposure and meet BOD 26-04 patching guidelines. All organisations should review their exposure and follow vendor instructions.
For full details, see the [NVD entry for CVE-2026-96654](https://nvd.nist.gov/vuln/detail/CVE-2026-96654) and the [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).