Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server versions v1.43.2 and earlier contain an improper neutralization of encoded URI schemes in a web page vulnerability. This flaw could allow an attacker to call other plugins' functions and supply their own parameters, potentially enabling unauthorized actions. The vulnerability is part of a chain of related security issues, linked with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA has flagged this vulnerability and it is subject to BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements have also been outlined under the BOD 26-04 implementation guidance. Users are strongly advised to update to a patched version of Plex Media Server as soon as possible. The vulnerability has been assigned a high criticality rating.