Vulnerability record · CVE-2026-96652 · published 23 September 2026

CVE-2026-96652: Plex media server server-side request forgery (ssrf) vulnerability

Plex · Media Server

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

5.3 CVSS 4.0 Medium CISA KEV since 20 Oct 2026 EPSS 12% · top 3.8% CWE-918 · Server-side request forgery (SSRF)

5.3CVSS 4.0 base score

12%EPSS exploitation probability, 30 days

YesIn CISA KEV, fix deadline passed

1Affected product versions listed by NVD

5References

21 Oct 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Exploitation in the wild

CISA added CVE-2026-96652 to the Known Exploited Vulnerabilities catalog on 20 October 2026 as "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 3 November 2026.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Media Server Plex

References

Link	Tags
https://forums.plex.tv/t/plex-media-server/30447/711	Release Notes
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-96652	Third Party AdvisoryVDB Entry
https://zmain.info/blog/plex2shell	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652	US Government Resource

Track CVE-2026-96652 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-96656Plex media server vulnerabilityPlex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Option…KEVEPSS 1.8%23 Sep 2026 7.2CVE-2020-5741Plex Media Server Windows deserialization leads to Python code executionPlex Media Server on Windows deserializes untrusted data, allowing a remote, authenticated attacker to execute arbitrary Python code. The flaw is a C…KEVEPSS 73%analysed8 May 2020 6.9CVE-2026-96654Plex media server vulnerabilityPlex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' f…KEVEPSS 1.9%23 Sep 2026 5.3CVE-2026-96655Plex media server server-side request forgery (ssrf) vulnerabilityPlex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/un…KEVEPSS 11%23 Sep 2026 9.8CVE-2018-13415Plex media server xml external entity (xxe) vulnerabilityIn Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.…EPSS 31%13 Aug 2018 8.8CVE-2020-5742Plex media server vulnerabilityImproper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.EPSS 1.5%15 Jun 2020 8.8CVE-2019-19141Plex media server path traversal vulnerabilityThe Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account r…EPSS 4.7%19 Dec 2019 7.8CVE-2020-5740Plex media server uncontrolled search path element vulnerabilityImproper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privi…EPSS 0.75%22 Apr 2020

Source: NIST National Vulnerability Database (record CVE-2026-96652), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.