Plex Media Server SSRF Vulnerability (CVE-2026-96655)

Catalog analysis: CISA added this entry on October 20, 2026. The entry reflects catalog information retrieved on October 21, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-96655 is a Server-Side Request Forgery (SSRF) vulnerability identified in Plex Media Server. The flaw allows an authenticated user to force the server to make requests to arbitrary internal or external addresses. This is achieved by manipulating the /video/:/transcode/universal path parameter.

Of particular concern for vulnerability management teams is that this vulnerability can be chained with other flaws, specifically CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, potentially increasing the overall impact of an exploit.

Exposure and applicability

This vulnerability applies to installations of Plex Media Server. The attack vector requires the actor to be an authenticated user; it is not described as a pre-authentication flaw.

Infrastructure owners should prioritize assets based on their network positioning. Systems that are internet-exposed or reside in segments with access to sensitive internal management interfaces are at higher risk, as SSRF can be used to probe or interact with internal services that the attacker cannot reach directly.

Remediation priorities

Our analysis suggests the following prioritization for remediation:

1. Immediate Patching: Apply vendor-provided mitigations and updates according to official instructions. This is the primary method for reducing exposure.
2. Chain Analysis: Because CVE-2026-96655 can be chained with three other vulnerabilities (CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656), defenders should verify the patch status of all four CVEs simultaneously rather than treating them as isolated issues.
3. Network Segmentation: As a compensating control to limit damage, restrict the Plex Media Server’s ability to initiate outbound requests to internal network segments where no legitimate business need exists.

How to validate remediation

Verification must go beyond confirming a version number. To ensure exposure is actually reduced, defenders should consider the following:

• Configuration Audit: Verify that the vendor-prescribed mitigations are active and correctly configured on the host.
• Egress Filtering Validation: If network segmentation was used as a compensating control, validate via firewall logs or authorized network tests that the server cannot reach sensitive internal IP addresses via the affected path.
• Authenticated Testing: In a controlled environment, verify whether an authenticated account can still trigger requests to an external listener through the /video/:/transcode/universal parameter.

Limits and open questions

While the vulnerability is documented, it remains unknown if this flaw has been utilized in known ransomware campaigns. Additionally, while patching reduces the likelihood of exploitation, residual risk may remain if authenticated accounts are compromised via other means (e.g., credential theft), as the vulnerability relies on an authenticated state.

Source and editorial note

CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability · Source date: October 20, 2026 · Retrieved October 21, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment