CISA has added CVE-2026-96652, a server-side request forgery (SSRF) flaw in Plex Media Server, to its Known Exploited Vulnerabilities catalog, which confirms it is being exploited in the wild.
What Is It
CVE-2026-96652 is an SSRF vulnerability (CWE-918) in the /player/timeline endpoint of Plex Media Server. According to NVD, an attacker using any X-Plex-Token value can put a full URL in the protocol parameter. That makes the Plex server send a POST request to whatever destination the attacker chooses.
NVD rates it CVSS 3.1 4.3 (MEDIUM) (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and CVSS 4.0 5.3 (MEDIUM).
Why It Matters
The base score is moderate, but CISA added this flaw to the KEV catalog on 2026-10-20, which confirms active exploitation. CISA's SSVC assessment changed from "exploitation: none" in September to "exploitation: active" on 2026-10-20.
CISA also says the flaw can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Chaining could make the impact much worse than the score for this single CVE suggests. CISA lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Product: Plex Media Server
- Affected: versions before 1.43.3.10861
- Unaffected: 1.43.3.10861
The vendor forum notice linked from the KEV entry refers to "v1.43.2 and earlier." The NVD CPE configuration lists the cutoff as versionEndExcluding 1.43.0.10861, which conflicts with the NVD description. Treat any build before 1.43.3.10861 as vulnerable.
Patch Status
The fixed version is Plex Media Server 1.43.3.10861, and Plex has published a security update notice.
CISA's required action: apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations are unavailable, follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for evaluating each asset's internet exposure. The federal remediation due date is 2026-11-03.
Plex operators should upgrade to 1.43.3.10861 or later now. They should also review the chained CVEs listed above.
Sources
- CISA KEV Catalog – CVE-2026-96652
- NVD – CVE-2026-96652
- CVE.org Record
- Plex Forums – Important Security Update for Plex Media Server v1.43.2 and Earlier
- Plex Forums – Plex Media Server Release Notes
- CISA CSAF Advisory VA-26-266-01
- zmain.info – plex2shell
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance