CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

CISA's October 20 alert lists "CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability"[2] among six newly added known exploited vulnerabilities.According to the CVE record published by OffSeq, Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.[3] Strix reports that the bug is rated 4.3/10 on the CVSS scale[4].SentinelOne says "because the server originates the request, the attacker inherits Plex's network reachability."[5] The firm adds that the flaw "does not directly grant code execution, but SSRF often serves as a precursor to deeper compromise"[5].SecurityWeek reports that CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 "can be combined to run arbitrary code on an exposed server without valid credentials."[1] According to the outlet, the researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16.[1]Gizmodo describes the chain this way: an attacker "can trick a server into handing over its owner's admin token, then plant a malicious file"[6] that runs when Plex transcodes a video.DailyCVE advises users to upgrade Plex Media Server to version 1.43.3.10861 or any later release[7]. It also recommends against exposing Plex instances directly to the public internet without a secure VPN layer.[7]