ZeroDayAlert

CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Plex Media Server Added to KEV 2026-10-20 Federal due 2026-11-03 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Plex Media Server is affected by this vulnerability. The flaw allows an attacker with any valid X-Plex-Token to craft requests that force the server to make HTTP POST calls to attacker-controlled destinations. The record does not specify which versions of Plex Media Server are vulnerable, nor does it detail whether this affects self-hosted deployments, cloud-hosted instances, or both.

How to check whether this touches you

  • Inventory whether you run Plex Media Server in your environment, including any instances used for internal media distribution or testing.
  • Determine whether your Plex server is reachable over a network (either the internet or an internal network where untrusted clients reside), since the attacker needs network access to exploit it.
  • Check your Plex deployment logs and authentication records for any X-Plex-Token usage patterns that could indicate token distribution or compromise.
  • Establish the running version of Plex Media Server on each affected instance; version strings alone are a signal of risk, though security patches may be backported to older versions by your vendor or distribution.
  • Review whether your Plex server makes outbound HTTP or HTTPS connections as part of normal operation, which would amplify the impact of this SSRF vulnerability.

What to do

  1. Immediately restrict network access to Plex Media Server by placing it behind a firewall rule or access control list that limits connections to trusted clients or IP ranges only.
  2. Rotate or invalidate all X-Plex-Token values in use, and issue new tokens only to authorised users; document the rotation date and affected tokens.
  3. Enable and review all available Plex server access and authentication logs, paying attention to failed authentication attempts and unusual token usage patterns.
  4. Check the Plex vendor advisory and apply any available patches or configuration mitigations according to their guidance and CISA BOD 26-04 timelines; if no patch is available and network restriction is not feasible, prepare to discontinue use of the product.
  5. If your Plex instance is cloud-hosted, follow your cloud provider's patching and vulnerability disclosure process, and confirm compliance with BOD 26-04 deadlines before the federal remediation due date of 2026-11-03.

If you find you were exposed

An attacker exploiting this vulnerability could have forced your Plex server to make POST requests to external systems, potentially exfiltrating data, triggering downstream attacks, or probing internal services. Review your server's outbound connection logs and firewall records from the deployment date backwards to the present, looking for unexpected POST requests to unfamiliar destinations. Log retention is typically your limiting factor; if logs do not exist beyond the current date, document the gap and begin capturing logs immediately to support any incident investigation.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-96652 is being exploited. It cannot tell you whether Media Server is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →