CVE-2026-96654

CVE-2026-96654 is a vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw arises from the improper neutralization of URL values within the "searchOne" endpoint. This allows an attacker to call functions belonging to other plugins and supply custom parameters, enabling them to obtain the server owner's administrator token. This vulnerability is tracked as part of a chain of four security flaws collectively referred to as "Plex2Shell". When chained together, these flaws allow attackers to execute arbitrary code on vulnerable Plex Media Server instances without needing valid credentials. Following the public release of a proof-of-concept exploit, threat actors have actively targeted these vulnerabilities in the wild to deploy cryptocurrency miners and reverse proxy software. The issue was patched by Plex in August 2026.