Plex Media Server: CVE-2026-96652 SSRF Exploited in the Wild

What it is and who is affectedPlex Media Server carries a server-side request forgery (SSRF) flaw tracked as CVE-2026-96652, classified under CWE-918....

What it is and who is affected

Plex Media Server carries a server-side request forgery (SSRF) flaw tracked as CVE-2026-96652, classified under CWE-918. According to the National Vulnerability Database (NVD) of NIST, the issue affects Plex Media Server before 1.43.3.10861. The record was published on 23 September 2026.

The mechanism is straightforward and worth understanding: an attacker using any X-Plex-Token value can place a full URL in the protocol parameter of the /player/timeline endpoint and force the Plex server to send a POST request to a destination of their choosing. In other words, the server itself becomes the sender of the malicious request, which is exactly what makes SSRF useful to an intruder.

NVD rates the vulnerability CVSS 4.0 5.3, MEDIUM. That score deserves context: a medium rating does not mean low priority. The CISA description notes that this flaw can be chained with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, so its real impact depends on what sits alongside it in the same environment.

Who should care in practice? Any organisation running Plex Media Server on its own infrastructure — a small business with a media library on a dedicated machine, a shop or studio that streams in-house content, or a company whose IT team installed it on a server that also hosts other services. If the instance is reachable from the internet, the exposure is greater.

Why it is urgent

This is not a theoretical finding waiting for a proof of concept. CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, which means there is evidence of exploitation in real attacks. The agency set a remediation deadline of 3 November 2026 for US federal agencies.

The action CISA requires is to apply mitigations in line with the vendor's instructions, following its BOD 26-04 guidance on prioritising security updates by risk, and to apply the corresponding forensic triage requirements. CISA also states that organisations should assess each asset's internet exposure and, where mitigations are unavailable, discontinue use of the product.

Two details matter for planning. First, the material does not record this vulnerability as used in ransomware campaigns, so there is no confirmed link to extortion operations at this stage. Second, the exploitation evidence is enough on its own: an SSRF that is already being abused in the wild is a live risk, not a future one.

What to do today

Inventory. Confirm whether Plex Media Server is running anywhere in the organisation, including departmental machines, test servers and NAS devices that nobody formally manages.
Check the version. Compare what is installed against the affected range: anything below 1.43.3.10861 falls inside it according to NVD.
Update or mitigate. Apply the update or mitigation indicated in the vendor's advisory and release notes. If the material you consult does not state a specific fixed build, follow whatever the manufacturer's notice prescribes rather than guessing.
Look for signs of intrusion. Review outbound connections from the Plex host, unexpected POST traffic, unusual requests to the timeline endpoint and any anomalous use of tokens. CISA's forensic triage guidance is a sensible reference for this step.
Reduce internet exposure. If the service does not need to be publicly reachable, restrict it to the internal network or behind a VPN, and review firewall rules and port forwarding on the router.
Rotate credentials. Since the flaw can be triggered with any token value, treat tokens and related access credentials as potentially compromised.

For a small IT team in Barcelona, Lleida, Tarragona or Girona, the practical difficulty is rarely the patch itself — it is knowing that the asset exists and who owns it. A simple, current inventory of internet-facing services closes most of that gap.

How a cybersecurity team can help

Incidents like this one tend to surface a broader pattern: a media server installed years ago for a specific project, never documented, still listening on a public port. An external team can map that surface properly, run security audits and pentesting to find the vulnerabilities that matter before someone else does, and harden servers so that a single misconfigured endpoint does not become an entry point.

Continuous monitoring and incident response matter just as much once a flaw is being exploited. When something does go wrong, the priority is to contain it, understand what was touched and restore service safely — including repairing a hacked website or cleaning an infected host. For businesses running WordPress, PrestaShop or Joomla alongside their internal tools, keeping patches and updates current is the least glamorous and most effective control available. At ALMC we work with SMEs and online shops across Catalonia on exactly this: closing vulnerabilities before they are exploited, and responding quickly when they are.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.