CVE-2026-96654Vulnerability

1. “CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability”

   The Hacker NewsNews21 Oct 2026
   CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

2. “CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability”

   CISA advisoriesGovernment20 Oct 2026
   CISA Adds Six Known Exploited Vulnerabilities to Catalog

3. “The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.”

   Security AffairsNews19 Oct 2026
   Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners

4. “CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token.”

   The Hacker NewsNews19 Oct 2026
   Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

5. “Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials.”

   SecurityWeekNews19 Oct 2026
   Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

• 217.60.194[.]116in 1 report
• ota.proxystream[.]stin 1 report
• zmain[.]comin 1 report
• 91.92.40[.]202in 1 report
• 176.65.139[.]228in 1 report
• 45.194.92[.]222in 1 report
• global.relay.proxystream[.]stin 1 report

Also named with it: CVE-2026-96652, CVE-2026-96655, CVE-2026-96656, CVE-2026-106931, CVE-2026-110936, CVE-2026-96651