Plex Media Server sits on the boundary between a home network and the internet. CVE-2026-96655 is a server-side request forgery flaw in that boundary, and CISA added it to the Known Exploited Vulnerabilities catalog on 20 October 2026. The official Plex advisory covers Media Server 1.43.2 and earlier, and the fix ships in 1.43.3.10861. Anyone running a self-hosted server should treat the upgrade as routine maintenance rather than an emergency rearchitecture, but the upgrade needs to happen.

The vulnerability in plain terms

The advisory describes an authenticated user reaching the /video/:/transcode/universal endpoint and supplying a path parameter that the server then fetches. Because the server performs the fetch, it can be pointed at addresses the user cannot reach directly: loopback services, private ranges, link-local metadata endpoints, or hosts behind the same firewall. The weakness maps to CWE-918, server-side request forgery.

How an attacker gets there

The first condition is authentication. That reduces the population of attackers compared with an unauthenticated remote code execution bug, but it does not make the flaw benign. Plex servers commonly have several accounts: household members, shared users, and in some deployments accounts issued by a managed hosting provider. Any of those is enough to start.

The second condition is reachability of the transcoding endpoint. If the server is published through a reverse proxy that restricts paths, the attack surface shrinks. If it is exposed directly, every authenticated account reaches it.

The third condition is that the request target must be useful to the attacker. A forged request that returns nothing is a wasted request. Internal dashboards, administrative APIs bound to loopback, and cloud instance metadata services are the usual targets, and they are exactly the kind of service a media server often shares a network with.

What the impact looks like in practice

Server-side request forgery rarely produces a single dramatic outcome. It produces a capability: the ability to make a trusted host issue requests on the attacker's behalf. On a home network that may mean enumerating the router's management interface. In a small business deployment it may mean reaching an internal ticketing system or a monitoring dashboard. On a cloud-hosted instance it may mean querying the metadata service, which is the reason cloud providers keep adding protections to that endpoint.

The chaining note widens the picture. If an attacker can combine the SSRF with the encoded-URI-scheme issue or the file-name issue, the sequence can move from reading internal responses to influencing what the server executes or where it writes.

Affected versions and scope

Affected: Plex Media Server 1.43.2 and earlier. Fixed: 1.43.3.10861 and later. The advisory does not carve out a platform exception, so treat every supported operating system as covered.

Exposure context and what the number means

A ZoomEye query for app="Plex Media Server" returns 507,974 matching product assets at the time of this analysis. That figure describes how many devices ZoomEye fingerprints as Plex Media Server. It does not describe how many of them run a vulnerable version. A vul.cve="CVE-2026-96655" query returned zero, which means the CVE is not yet indexed against specific assets rather than that no vulnerable host exists.

Remediation

Upgrade to 1.43.3.10861 or later. On Docker, pull a rebuilt image rather than assuming the tag moved. On package installs, confirm the running binary version after the upgrade.

Where immediate upgrading is impossible, reduce the paths that reach the transcoding endpoint. Put the server behind a reverse proxy that rejects /video/:/transcode/universal for untrusted clients. Remove shared accounts that do not need remote access. Isolate the server on a network segment that cannot reach management interfaces, and block link-local metadata addresses at the host firewall.

References

  • CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-96655

  • Plex security advisory for Media Server 1.43.2 and earlier

  • NVD record for CVE-2026-96655