CVE-2026-96655
published 2026-09-23CVE-2026-96655: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal'…
PriorityP181medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-11-03
Exploited in the wild
EPSS
1.64%
76.2th percentile
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| plex | media_server | < 1.43.3.10861 | 1.43.3.10861 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck4.3MEDIUM
cisa4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Plex Media Server up to 1.42.1 Transcode transcode server-side request forgery
vuldb·2026-10-20·CVSS 4.3
CVE-2026-96655 [MEDIUM] Plex Media Server up to 1.42.1 Transcode transcode server-side request forgery
A vulnerability was found in Plex Media Server 0.9.9.2/0.9.9.2.374/0.9.9.3/0.9.9.10/1.42.1 and classified as problematic. The impacted element is an unknown function of the component Transcode. Executing a manipulation of the argument transcode can lead to server-side request forgery.
This vulnerability is tracked as CVE-2026-96655. The attack can be launched remotely. Moreover, an exploit is present.
It is suggested to upgrade the affected component.
GHSA
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
ghsa_unreviewed·2026-09-23
CVE-2026-96655 [MEDIUM] CWE-918 Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
VulnCheck
plex media_server Server-Side Request Forgery (SSRF)
vulncheck·2026·CVSS 4.3
CVE-2026-96655 [MEDIUM] plex media_server Server-Side Request Forgery (SSRF)
plex media_server Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Affected: plex media_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
CISA
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96654 [MEDIUM] CWE-84 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Vulnerability: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Affected: Plex Media Server
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailabl
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96655 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
CISA
Plex Media Server External Control of File Name or Path Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96656 [MEDIUM] CWE-73 Plex Media Server External Control of File Name or Path Vulnerability
Vulnerability: Plex Media Server External Control of File Name or Path Vulnerability
Affected: Plex Media Server
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asse
CISA
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
cisa·2026-10-20·CVSS 4.3
CVE-2026-96652 [MEDIUM] CWE-918 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Vulnerability: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Affected: Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the prod
No detection rules found.
No public exploits indexed.
Hackernews
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
blogs_hackernews·2026-10-21·CVSS 8.5
CVE-2026-96652 [HIGH] CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell .
The vulnerabilities are listed below -
CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability
CVE-2026-9665
Hackernews
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
blogs_hackernews·2026-10-19·CVSS 6.5
CVE-2026-96652 [MEDIUM] Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.
According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell .
The vulnerabilities are below -
CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by ta
https://forums.plex.tv/t/plex-media-server/30447/711https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonhttps://www.cve.org/CVERecord?id=CVE-2026-96655https://zmain.info/blog/plex2shellhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655
2026-09-23
Published
2026-10-20
Added to CISA KEV
Exploited in the wild