CVE-2026-96652
Attacker can force Plex server to send requests to any destination
Plex Media Server allows server-side request forgery through the /player/timeline endpoint. An attacker using any X-Plex-Token value can put a full URL in the protocol parameter and make the server send a POST request to a destination they choose. Versions before 1.43.3.10861 are affected, and CISA has added this to its known exploited list because it is being actively exploited.
Plex Media Server · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 3 Nov
SeveritymediumCVSS 5.3 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Media Server 1.43 | 1.43.3.10861 |
What to do
- Update Plex Media Server to 1.43.3.10861, which contains the fix. If you are in a US federal agency, apply the fix by 2026-11-03 as CISA requires. Check CISA's known exploited vulnerabilities catalog for guidance.
What happened
- 20 OctCISA added this vulnerability to its Known Exploited Vulnerabilities catalog.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-96652 | Plex Media Server SSRF | medium 5.3 | 20 Oct | 1.8% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-96652 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works