Plex Media Server: SSRF flaw CVE-2026-96655 exploited in the wild

Plex Media Server: SSRF flaw CVE-2026-96655 exploited in the wild

What CVE-2026-96655 is and who it affectsCVE-2026-96655 is a server-side request forgery (SSRF) vulnerability in Plex Media Server, classified as CWE-...

What CVE-2026-96655 is and who it affects

CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability in Plex Media Server, classified as CWE-918. According to the National Vulnerability Database (NVD) of NIST, the flaw affects Plex Media Server versions before 1.43.3.10861 (the NVD entry lists affected releases up to 1.43.0.10861, not including it). The issue was published in the NVD on 23 September 2026.

A server in an office rack with a network cable slipping through a wall towards a locked cabinet, illustrating an SSRF flaw

In practice, an authenticated user can force the server to send requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. That matters because a media server usually sits inside the local network, close to other machines, storage and management interfaces that were never meant to be reachable from the outside. The vulnerability can also be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656, which raises the potential impact well beyond a single misdirected request.

The assigned severity is CVSS 4.0 score of 5.3 (MEDIUM). A medium score is easy to dismiss, but severity ratings describe the flaw in isolation, not the position of the asset in your network. A Plex instance running on the same server as a small company's file shares or an internal admin panel is a very different risk from one on an isolated machine.

Why it is urgent: already exploited and on the KEV catalogue

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, which means it has been observed in real attacks. CISA has set US federal agencies a remediation deadline of 3 November 2026, and asks them to apply mitigations in line with the vendor's instructions, following its BOD 26-04 guidance on risk-based security updates and its forensics triage requirements. Where mitigations are unavailable for cloud services, the guidance points to discontinuing use of the product.

Those deadlines bind US federal agencies, not Spanish private companies, but the signal is the same for everyone: the window between publication and exploitation has closed. CISA's material does not list this CVE as used in ransomware campaigns, so there is no confirmed ransomware link to report. The absence of that link is not reassurance; initial access is often the quiet stage that precedes everything else.

What to do today

  • Find out whether Plex Media Server is running on any company machine, including the workstation of the person who manages the office, a NAS, or a spare server in the rack. Shadow IT is common with media software.
  • Check the version. Anything below 1.43.3.10861 is in scope. Confirm the exact build rather than relying on the update notification inside the application.
  • Apply the update or mitigation indicated in the vendor's advisory. The release notes published on the Plex forums are the reference point; follow whatever the vendor states for your version rather than improvising a fix.
  • Review for signs of intrusion. Look for unexpected outbound requests from the server, unusual authentication activity, and access to internal addresses that the media service has no reason to contact. If the instance is internet-facing, treat any suspicious pattern as a possible compromise until proven otherwise.
  • Reduce what is exposed to the internet. Media servers rarely need to be publicly reachable from the open internet. Put them behind a VPN or a restricted access rule, and segment them away from servers that hold customer data, invoices or credentials, in line with GDPR principles of minimisation and security of processing.

How a cybersecurity team such as ALMC's can help

For a small IT team in Lleida, Barcelona, Tarragona or Girona, the hard part is rarely applying one patch. It is knowing what is installed across the estate, which versions are running, and which services are exposed. That is where an external security team earns its keep: an inventory and vulnerability audit surfaces forgotten instances, a pentest shows what an authenticated attacker could actually reach from a compromised account, and server hardening closes the paths that SSRF-style flaws rely on.

When something does go wrong, incident response matters more than any single tool. If a WordPress, PrestaShop or Joomla site has already been hacked, the work is to contain, clean and rebuild with confidence rather than patch over the damage. Ongoing monitoring and maintenance of those platforms, together with prompt application of security patches, keeps the same story from repeating with the next CVE. The goal is simple: find and close the gaps before someone else does.

Related

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.