CISA lists exploited Plex Media Server SSRF (CVE-2026-96655)
Original title: CISA KEV: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — Plex Media Server (CVE-2026-96655)
Authenticated users on builds before 1.43.3.10861 can request arbitrary addresses; the KEV due date is November 3.
CISA added CVE-2026-96655, a server-side request forgery flaw in Plex Media Server, to its Known Exploited Vulnerabilities catalog. Versions before 1.43.3.10861 let an authenticated user request arbitrary internal or external addresses through the '/video/:/transcode/universal' path parameter. Agencies must apply vendor mitigations under BOD 26-04 or stop using the product, with a due date of November 3, 2026. Known ransomware use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown.
- The vulnerable path is '/video/:/transcode/universal'.
- The flaw requires an authenticated user.
- CISA’s remediation due date is November 3, 2026.
- Known ransomware campaign use is marked Unknown.
Impact: Authenticated user can request arbitrary internal or external addresses.
| Product | Affected |
|---|---|
| Plex Media Server | before 1.43.3.10861 |
- 1.Apply vendor mitigations and follow CISA BOD 26-04 by November 3, 2026.
- 2.Discontinue Plex Media Server if mitigations are unavailable.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 5.3 | 2% | KEV | KEV |
From the original article
1 min read at cisa.govPlex Media Server before 1. 43. 3.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.