CVE-2026-96655KEV · due Nov 3CWE-918ssrf

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Medium · published September 23, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 4.3. It is confirmed in active exploitation. It sits in the 38.5th percentile for exploit probability.

10
days to CISA
deadline
CVSS v3.1
4.3
EPSS
0%
Percentile
38.5
In the wild
Confirmed
What it is

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-23T21:17Z
KEV added
2026-10-20 · due 2026-11-03
Affected products (1)
ProductVersionsFixed in
plex/media_server< 1.43.3.108611.43.3.10861
References (5)
https://www.cve.org/CVERecord?id=CVE-2026-96655 · 9119a7d8-5eab-497f-8521-727c672e3725https://zmain.info/blog/plex2shell · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://forums.plex.tv/t/plex-media-server/30447/711 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 16:06Z
    Plex Media Server arbitrary-host SSRF
    cvelistv5