CVE-2026-96652
published 2026-09-23CVE-2026-96652: Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol'…
PriorityP180medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-11-03
Exploited in the wild
EPSS
1.82%
78.6th percentile
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| plex | media_server | < 1.43.3.10861 | 1.43.3.10861 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck4.3MEDIUM
cisa4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96654 [MEDIUM] CWE-84 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Vulnerability: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Affected: Plex Media Server
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailabl
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96655 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
CISA
Plex Media Server External Control of File Name or Path Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96656 [MEDIUM] CWE-73 Plex Media Server External Control of File Name or Path Vulnerability
Vulnerability: Plex Media Server External Control of File Name or Path Vulnerability
Affected: Plex Media Server
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asse
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96652 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the prod
VulDB
Plex Media Server up to 1.42.1 protocol server-side request forgery
vuldb·2026-10-20·CVSS 4.3
CVE-2026-96652 [MEDIUM] Plex Media Server up to 1.42.1 protocol server-side request forgery
A vulnerability, which was classified as critical, was found in Plex Media Server 0.9.9.2/0.9.9.2.374/0.9.9.3/0.9.9.10/1.42.1. Impacted is an unknown function. Such manipulation of the argument protocol leads to server-side request forgery.
This vulnerability is referenced as CVE-2026-96652. It is possible to launch the attack remotely. Furthermore, an exploit is available.
You should upgrade the affected component.
GHSA
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
ghsa_unreviewed·2026-09-23
CVE-2026-96652 [MEDIUM] CWE-918 Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
VulnCheck
plex media_server Server-Side Request Forgery (SSRF)
vulncheck·2026·CVSS 4.3
CVE-2026-96652 [MEDIUM] plex media_server Server-Side Request Forgery (SSRF)
plex media_server Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Affected: plex media_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
No detection rules found.
No public exploits indexed.
Hackernews
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
blogs_hackernews·2026-10-21·CVSS 8.5
CVE-2026-96652 [HIGH] CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell .
The vulnerabilities are listed below -
CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability
CVE-2026-9665
Hackernews
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
blogs_hackernews·2026-10-19·CVSS 6.5
CVE-2026-96652 [MEDIUM] Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.
According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell .
The vulnerabilities are below -
CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by ta
https://forums.plex.tv/t/plex-media-server/30447/711https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonhttps://www.cve.org/CVERecord?id=CVE-2026-96652https://zmain.info/blog/plex2shellhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652
2026-09-23
Published
2026-10-20
Added to CISA KEV
Exploited in the wild