CVE-2026-96652KEV · due Nov 3CWE-918ssrf

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Medium · published September 23, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 4.3. It is confirmed in active exploitation. It sits in the 38.6th percentile for exploit probability.

9
days to CISA
deadline
CVSS v3.1
4.3
EPSS
0%
Percentile
38.6
In the wild
Confirmed
What it is

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00455 · 38.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-23T21:17Z
KEV added
2026-10-20 · due 2026-11-03
Affected products (1)
ProductVersionsFixed in
plex/media_server< 1.43.3.108611.43.3.10861
References (5)
https://forums.plex.tv/t/plex-media-server/30447/711 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-96652 · 9119a7d8-5eab-497f-8521-727c672e3725https://zmain.info/blog/plex2shell · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 16:06Z
    Plex Media Server SSRF
    cvelistv5