CVE-2026-96655: medium-severity vulnerability in Plex Media Server
Plex Media Server arbitrary-host SSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plex Media Server has a flaw that lets a logged-in user make the server request arbitrary internal or external addresses. This could be used to reach services the user should not be able to access.
Plex Media Server versions before 1.43.3.10861 are vulnerable to Server-Side Request Forgery (CWE-918) via the '/video/:/transcode/universal' path parameter. An authenticated user can make the server issue requests to arbitrary internal or external hosts, with a CVSS score of 5.3 (MEDIUM). Impact is limited to information exposure and access to internal network resources reachable from the server, and no additional details are provided in the advisory.
In the same product, most dangerous first.