CISA has added CVE-2026-96655, a server-side request forgery flaw in Plex Media Server, to its Known Exploited Vulnerabilities catalog. That means CISA has evidence it is being exploited in the wild.
What Is It
CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability (CWE-918) in Plex Media Server. An authenticated user can make the server send requests to internal or external addresses through the /video/:/transcode/universal path parameter.
NVD rates it CVSS 3.1 4.3 (MEDIUM) (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and CVSS 4.0 5.3 (MEDIUM). The flaw is reachable over the network, has low attack complexity, needs low privileges and requires no user interaction. The rated impact is limited to confidentiality.
Why It Matters
The base score is moderate, but CISA added this CVE to the KEV catalog on 2026-10-20, which means CISA has evidence of active exploitation. CISA's SSVC assessment changed from "exploitation: none" (2026-09-14) to "exploitation: active" (2026-10-20). Technical impact is rated "partial" and the attack is rated not automatable.
CISA also says this flaw can be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656. Defenders should weigh the chain, not this CVE's score alone. Known ransomware campaign use is listed as "Unknown."
What's Vulnerable
- Product: Plex Media Server
- Affected: versions before 1.43.3.10861, per the NVD description and CNA affected data
- Unaffected: 1.43.3.10861
The vendor advisory linked from KEV covers "Plex Media Server v1.43.2 and earlier." The NVD CPE configuration lists versionEndExcluding: 1.43.0.10861, which does not match the CNA data. Treat any version below 1.43.3.10861 as vulnerable.
Patch Status
Plex has published a security update. According to the NVD affected data, version 1.43.3.10861 is not vulnerable.
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Agencies should follow BOD 26-04 guidance for cloud services, or stop using the product if no mitigations are available. Stakeholders must assess each asset's internet exposure. For this entry, the KEV record marks forensic triage as "No."
Federal remediation due date: 2026-11-03.
Sources
- CISA KEV Catalog – CVE-2026-96655
- NVD – CVE-2026-96655
- CVE.org Record – CVE-2026-96655
- Plex Forums – Important Security Update for Plex Media Server v1.43.2 and Earlier
- Plex Forums – Plex Media Server Release Notes
- CISA CSAF Advisory VA-26-266-01
- zmain.info – plex2shell
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance