Zero Radar
← feed
CriticalVulnerabilityCVE-2026-96655updated 25 Oct 2026, 17:20 UTC

Plex Media Server lets logged-in users make it reach internal addresses

A logged-in Plex user can trick the server into fetching web addresses it should not reach, including systems inside your own network. Attackers already use this flaw in real attacks.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 5.3 of 10
Being exploited?YesConfirmed by CISA KEV · 20 Oct 2026
Fix available?YesPlex Media Server 1.43.3.10861 or later · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker logs inUses any valid Plex user account
  2. 2Crafted transcode requestSent to /video/:/transcode/universal
  3. 3Server makes requestPlex fetches an address chosen by attacker
  4. 4Internal systems reachedHidden services may be probed or accessed
  5. ResultInternal network reached through Plex server

What happened

Plex Media Server versions before 1.43.3.10861 have a server-side request forgery (SSRF) flaw in the '/video/:/transcode/universal' path parameter, letting an authenticated user make the server request arbitrary internal or external addresses.

Why it is dangerous: An attacker with a Plex account could use the server to probe or reach internal services that are otherwise hidden from the internet. CISA says it can be chained with other Plex flaws, and exploitation is confirmed.

Are you affected?

You are affected if you run Plex Media Server older than 1.43.3.10861 and allow users to sign in to it.

Plex Media Server before 1.43.3.10861

What to do

  1. Update Plex Media Server to 1.43.3.10861 or later
  2. Review which users have access to your Plex server and remove any you do not recognize
  3. Check server logs for unusual transcode requests and follow CISA's forensics triage guidance if you find any
  4. Limit exposure of the Plex server to the internet where possible

Timeline

  1. 23 Sept 2026, 18:31 UTC
    Publicly disclosed
  2. 20 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:20 UTC
    Fix: Plex Media Server 1.43.3.10861 or later

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-96655 · GHSA-9x88-w2p7-56vh
CVSS
5.3 / 10
EPSS
1.6% chance of exploitation within 30 days
Disclosed
23 Sept 2026, 18:31 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Plex Media Server lets logged-in users make it reach internal addresses · Zero Radar