Zero Radar
← feed
CriticalVulnerabilityCVE-2026-96652updated 25 Oct 2026, 17:20 UTC

Plex Media Server can be tricked into sending requests to attacker-chosen addresses

A flaw lets someone with any valid login token make your Plex server send outgoing requests to a website or system of their choosing. This can be used to probe your internal network or reach services you did not intend to expose.

Exploited (CISA KEV)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 5.3 of 10
Being exploited?YesConfirmed by CISA KEV · 20 Oct 2026
Fix available?YesPlex Media Server 1.43.3.10861 or later · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestUses any valid X-Plex-Token value
  2. 2Plex serverAccepts a full URL in 'protocol' parameter
  3. 3Forced outgoing POSTServer posts to attacker-chosen destination
  4. 4Internal or external targetAttacker reaches systems the server can access
  5. ResultAttacker uses server to reach targets

What happened

Server-side request forgery (SSRF) in Plex Media Server via the '/player/timeline' endpoint: the 'protocol' parameter accepts a full URL, causing the server to POST to an attacker-chosen destination. It can be chained with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.

Why it is dangerous: Attackers can use your Plex server as a relay to reach internal systems or external destinations, which can lead to data exposure or further compromise of your network. Exploitation is confirmed, and CISA has added it to its Known Exploited Vulnerabilities catalog.

Are you affected?

You are affected if you run Plex Media Server older than 1.43.3.10861, especially if it is reachable from the internet.

Plex Media Server before 1.43.3.10861

What to do

  1. Update Plex Media Server to version 1.43.3.10861 or later
  2. If you cannot update immediately, restrict Plex access so it is not exposed to the internet
  3. Review Plex server logs for unusual outgoing requests to '/player/timeline'
  4. Apply the CISA BOD 26-04 guidance and forensics triage steps if you are a federal agency or follow similar requirements

Timeline

  1. 23 Sept 2026, 18:31 UTC
    Publicly disclosed
  2. 20 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 21 Oct 2026, 07:26 UTC
    Reported by The Hacker News · The Hacker News
  4. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 25 Oct 2026, 17:20 UTC
    Fix: Plex Media Server 1.43.3.10861 or later

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-96652 · GHSA-5p7w-r379-3c2m
CVSS
5.3 / 10
EPSS
1.8% chance of exploitation within 30 days
Disclosed
23 Sept 2026, 18:31 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Plex Media Server can be tricked into sending requests to attacker-chosen addresses · Zero Radar