Plex Media Server: Server-side request forgery in transcode endpoint
Deadline for US federal agencies: 3 Nov 2026
Summary
Plex Media Server before 1.43.3.10861 lets an authenticated user make the server request arbitrary internal or external addresses through the path parameter of the /video/:/transcode/universal endpoint. An attacker can use the server to probe internal services and reach resources the server can access. CISA lists the flaw as known exploited, and public research describes it as one link in a chain with other Plex flaws.
Affected
- Plex Media Server before 1.43.3.10861
- Plex Media Server 1.43.3.10861 and later are not affected
Fixed in
- Plex Media Server 1.43.3.10861
- Plex Desktop: a fixed version is cited in secondary sources only, not confirmed by the vendor
Workaround
Unknown. No vendor workaround is documented in the reviewed sources. Removing internet exposure and restricting outbound traffic from the server reduce the risk until the update is applied.
Exploitation
- CISA lists CVE-2026-96655 in the Known Exploited Vulnerabilities catalog (added 2026-10-20).
- CISA SSVC assessment: exploitation active, not automatable, partial technical impact.
- Public research documents a chain with other Plex flaws; no further details are verified here.
Our recommendation
- Inventory all Plex Media Server installations and their versions, including Docker and NAS deployments.
- Update to Plex Media Server 1.43.3.10861 or later; for Docker, pull a rebuilt image instead of relying on an unchanged tag.
- Remove port forwarding and Remote Access from the internet, or place the server behind a VPN or authenticated proxy.
- Restrict outbound connections from the server, particularly to internal networks and cloud metadata addresses, and place it outside the general office network.
- Review existing accounts and remove unused shared or former-staff accounts.
- For servers that were reachable from the internet before patching, check for signs of compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-96655 www.cve.org
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- Plex Forum: Plex Media Server release announcement forums.plex.tv
- CISA CSAF advisory VA-26-266-01 raw.githubusercontent.com
- GitHub Advisory GHSA-9x88-w2p7-56vh github.com
- The Hacker News: CISA orders federal agencies to patch thehackernews.com
- Plex2shell research by zmain.info zmain.info
- plex2shell chain documentation (GitHub wiki) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:47.
Original description (NVD)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (5)
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-96655
- https://zmain.info/blog/plex2shell
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.