CVE-2026-96655

Server-Side Request Forgery (SSRF) in Plex Media Server. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 20 October 2026.

Product: Plex Media Server
Added to CISA's catalog: 20 October 2026
Federal fix-by date: 3 November 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
Sources: CISA’s catalog, NVD entry

CISA’s description.

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

CVE-2026-96656 External Control of File Name or Path, added 20 October 2026
CVE-2026-96654 Improper Neutralization of Encoded URI Schemes in a Web Page, added 20 October 2026
CVE-2026-96652 Server-Side Request Forgery (SSRF), added 20 October 2026

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.

CVE-2026-96655

CISA’s description.

More from Plex this year.