CVE-2026-96654
Plex Media Server before 1.43.3.10861: three CISA KEV bugs fixed by one release - unsanitized URLs in the 'searchOne' parameter let an attacker reach other plugins' functions with attacker-chosen arguments (CVE-2026-96654), and /player/timeline and /video/:/transcode/universal both take a full URL and fetch it, turning the media server into an SSRF pivot onto the internal network (CVE-2026-96652, CVE-2026-96655)
- Severity
- high
- Affected product
- Plex Media Server
- Affected versions
- Plex Media Server < 1.43.3.10861
- Fixed in
- Plex Media Server 1.43.3.10861
- Detection basis
- Component version range
- Shipped rule
- Plex Media Server: Plex Media Server before 1.43.3.10861: three CISA KEV bugs fixed by one release - unsanitized URLs in the 'searchOne' parameter let an attacker reach other plugins' functions with attacker-chosen arguments (CVE-2026-96654), and /player/timeline and /video/:/transcode/universal both take a full URL and fetch it, turning the media server into an SSRF pivot onto the internal network (CVE-2026-96652, CVE-2026-96655)
- Added to NewScan
- 2026-10-21
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Plex Media Server from its response and reports this CVE when the detected version falls inside the affected range below.
Related CVEs covered by this detection
The same shipped rule and upgrade also cover these identifiers:
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.