CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVSS 5.3 · Medium⚠ Actively exploited (CISA KEV)
5.3
CVSS score
Medium
Severity
Active
CISA KEV
No
Ransomware use
Nov 3, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, with a federal patch deadline of Nov 3, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Details
AffectedPlex · Media Server
WeaknessCWE-918
CVSS base score5.3 (Medium)
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPublishedSep 23, 2026
Added to CISA KEVOct 20, 2026
Federal patch deadlineNov 3, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-96655 being actively exploited?
Yes — CISA lists CVE-2026-96655 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-96655 affect?
CVE-2026-96655 affects Plex · Media Server.
How do I fix CVE-2026-96655?
Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 3, 2026. Then check whether your personal data was exposed in any related breach.