AI analysis
Claude Opus · 7 Nov 2026, 10:19 CET
Exploited Plex Media Server flaw lets attackers call other plugins' functions
Plex Media Server before 1.43.3.10861 mishandles URL values in 'searchOne', letting remote unauthenticated attackers invoke other plugins' functions. CISA lists it as exploited. Update affected servers now and review internet exposure.
In plain terms
Plex Media Server is software people and organisations use to organise and stream their own video, music and photo libraries. Versions before 1.43.3.10861 contain a flaw in a feature called 'searchOne'. The server does not properly clean up (neutralize) web addresses passed to it, so an attacker can trick it into running functions that belong to other plugins (add-on components) and choose the inputs those functions receive.
According to the scoring data, an attacker needs no account and no help from a user, only network access to the server. CISA has confirmed real-world attacks. Anyone running Plex Media Server, especially on a server reachable from the internet, should treat this as urgent.