CVE-2026-96655
Lets authenticated users make Plex Media Server connect to any internal or external address.
Plex Media Server has a server-side request forgery (SSRF) flaw in its video transcoding path. An authenticated attacker can use it to make the server request arbitrary internal or external addresses. Versions before 1.43.3.10861 are affected, and CISA confirms attackers are actively exploiting this vulnerability.
Plex Media Server · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 3 Nov
SeveritymediumCVSS 5.3 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Media Server 1.43 | 1.43.3.10861 |
What to do
- Update Plex Media Server to version 1.43.3.10861 or later.
- Restrict access to the server to only trusted users, as the flaw requires an authenticated account to exploit.
What happened
- 20 OctCISA adds the vulnerability to its Known Exploited Vulnerabilities Catalog.
- 3 NovDeadline for US federal agencies to patch the vulnerability against active exploitation.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | medium 5.3 | 20 Oct | 1.6% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-96655 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works