Log in Request a demo

Exploited vulnerability

Plex Media Server transcode SSRF (CVE-2026-96655)

A server-side request forgery in the /video/:/transcode/universal endpoint of Plex Media Server before build 1.43.3.10861.

  • On CISA KEV
CVE ID
CVE-2026-96655
CVSS
4.3 Medium (CVSS v3.1) and 5.3 Medium (CVSS v4.0), as scored by CISA in the CVE record
CISA KEV
Listed
Affected product
Plex Media Server (self-hosted: Windows, macOS, Linux, NAS and Docker)
Exploited
October 2026
Published
23 September 2026

In short

CVE-2026-96655 is a server-side request forgery in the /video/:/transcode/universal endpoint of Plex Media Server before build 1.43.3.10861. The CVE record says an authenticated user can request arbitrary internal or external addresses through the path parameter. Plex's own summary words it differently, as disclosure of the server owner's admin token. CISA added it to its Known Exploited Vulnerabilities catalog on 20 October 2026.

Profile MapVulnerability
  1. CVECVE-2026-96655
  2. ProductPlex Plex Media Server (self-hosted: Windows, macOS, Linux, NAS and Docker)
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedCheck your version · Update now

What it allows

The CVE record says Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the /video/:/transcode/universal path parameter. In the Plex2Shell chain the authenticated user is the attacker holding a stolen owner token.

The researcher says the transcoder fetches attacker-hosted media with no allowlist of hosts. The attacker uses this to bring a prepared video file onto the server. The file is then written into the Codecs folder with the file write described in CVE-2026-96656.

The sources do not agree on the wording of this CVE. The CVE record describes the transcode request forgery.

Plex's table of 19 October says disclosure of the owner's admin token. We follow the CVE record for what the flaw is and note Plex's wording because owners will see both.

Plex2Shell is the name for the chain of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. CISA's entry for each one says it can be chained with the other three. See how Plex2Shell chains the four CVEs in our news post.

In our checks on 23 October 2026, a GitHub search for this CVE id returned 3 repositories, the earliest created on 17 October. We did not run or link any of them.

Who is affected

Plex Media Server before build 1.43.3.10861, according to the CVE record. Plex says 1.43.3.10861 and later are not affected.

Plex's post title says 1.43.2 and earlier, while its 19 October update gives the build number as the cutoff. Use the build number. The researcher's README names builds up to 1.43.3.10828 as vulnerable, so an early 1.43.3 build can still be affected.

Plex's update guide covers Windows, macOS, Linux, NAS devices and Docker. Plex says an internet-reachable server older than 1.43.3.10861 should be assumed possibly compromised.

Timeline

  1. 1 Sep 2026

    Plex announces Plex Media Server 1.43.3 as a security release and says CVEs have been requested.

  2. 23 Sep 2026

    The CVE record is published, with CISA as the CVE numbering authority.

  3. 16 Oct 2026

    A public proof of concept is released, according to Plex.

  4. 19 Oct 2026

    Plex publishes the CVE details and says the flaws are being actively and widely exploited.

  5. 20 Oct 2026

    CISA adds the CVE to the Known Exploited Vulnerabilities catalog.

  6. 3 Nov 2026

    The CISA due date for US federal agencies.

What to do

  1. Check your version

    Open Plex Web, go to Settings, then General, and read the version. Anything older than 1.43.3.10861 is affected. Compare all four numbers of the build, not only 1.43.3.

  2. Update now

    Install Plex Media Server 1.43.3.10861 or later. On a NAS the package manager may be behind, so Plex says to download the package from its Downloads page and install it by hand.

  3. Cut exposure

    If you do not need remote access, turn it off under Settings, then Remote Access. Plex also advises against forwarding port 32400 directly unless you need it.

  4. Do not test the transcode path

    Do not send requests to the transcode paths to test a server. Read the version in Plex Web. Then watch for outbound connections you do not recognize and for sustained high CPU while nothing is playing, both of which Plex lists as signs of compromise.

  5. Rebuild if you cannot rule out a compromise

    Plex advises a clean installation instead of reusing the old data directory. Sign out of all devices in your Plex account, change the password, and treat anything the Plex service account could reach as exposed.

Questions

Is CVE-2026-96655 being exploited?

Plex says the flaws in this chain are being actively and widely exploited, and CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on 20 October 2026. CISA lists use in ransomware campaigns as unknown.

Which Plex Media Server version fixes it?

Plex Media Server 1.43.3.10861 and later. Check Settings, then General, in Plex Web, and compare all four numbers of the build.

Do I need to turn off remote access?

Plex advises turning off Remote Access if you do not need it and not forwarding port 32400 directly unless you need it. Updating is still required.

Does CVE-2026-96655 leak the owner's admin token?

Plex's table says so, but the CVE record describes a request forgery through the transcode path. Plex2Shell steals the token in an earlier step, according to the researcher.

Does it need a login?

The CVE record says an authenticated user. In the chain, the attacker already holds the owner's admin token by then.

In our research

  1. Plex2Shell: Four Plex Media Server CVEs Chained Into Remote Code Execution October 2026

Sources

  1. Important security update for Plex Media Server v1.43.2 and earlier Plex
  2. Known Exploited Vulnerabilities catalog CISA
  3. CVE-2026-96655 CVE Program
  4. CVE-2026-96655 NVD
  5. CWE-918: Server-Side Request Forgery (SSRF) MITRE
  6. Plex2Shell: Unauthenticated RCE in Plex Media Server zmain.info (researcher)

Last updated 23 October 2026

Browse the threat library

Keep exploring

Knowledge Hub