ZeroDayAlert

CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

Plex Media Server Added to KEV 2026-10-20 Federal due 2026-11-03 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Plex Media Server deployments are vulnerable to a server-side request forgery (SSRF) flaw accessible to authenticated users. The vulnerability lies in the /video/:/transcode/universal path and can be chained with other known Plex vulnerabilities to amplify impact. The record does not specify which versions of Plex Media Server are affected, nor does it detail whether self-hosted or cloud-hosted instances face different risk profiles.

How to check whether this touches you

  • Inventory your environment for any Plex Media Server installations, whether running on-premises, in cloud infrastructure, or on end-user devices.
  • Establish whether the server is reachable from untrusted networks (the internet, shared corporate networks, or guest Wi-Fi) and whether unauthenticated access is prevented by firewall rules or reverse-proxy authentication.
  • Confirm the running version of Plex Media Server by checking the web interface settings or administrative logs; version alone is a signal of potential exposure, as backported security fixes may exist in later minor releases.
  • Review access logs for the /video/:/transcode/universal path to identify whether this endpoint has been accessed, and by whom.
  • If your deployment integrates with external identity providers (LDAP, SAML, OAuth), verify that session management is enforced and that compromised user accounts cannot grant persistent access.

What to do

  1. Check the Plex vendor advisory and apply any available patches or mitigations immediately, following CISA BOD 26-04 guidance for your risk classification.
  2. If a patch is unavailable and cannot be deferred, restrict network access to Plex Media Server: allow only trusted internal IP ranges, disable remote access features, and require VPN authentication before any user can reach the service.
  3. Review and revoke authentication tokens or session credentials for all user accounts with access to Plex Media Server, particularly admin and library-sharing roles.
  4. Enable detailed logging on the Plex Media Server and any reverse proxy or firewall in front of it, capturing all requests to /video/:/transcode/universal and the source IP, authenticated user, and response status.
  5. If you cannot remediate within your organisation's SLA, escalate to your risk or compliance team and document the justification and interim controls; discontinue use of the product if mitigations genuinely remain unavailable after due diligence.

If you find you were exposed

Search your access logs backwards from the disclosure date (2026-10-20) to identify any suspicious requests to /video/:/transcode/universal or related transcode paths; SSRF exploits often probe internal services or cloud metadata endpoints, so look for requests to unusual destinations (127.0.0.1, 169.254.169.254, internal hostnames, or external IP ranges). Correlation with authentication logs and process execution on the Plex server host will help determine whether an attacker progressed beyond reconnaissance. Log retention is your constraint—if your logs do not extend back far enough, consult your incident response plan and consider forensic analysis of the Plex server filesystem and any connected storage.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-96655 is being exploited. It cannot tell you whether Media Server is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →