CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

OffSeq's threat database cites the CVE record as saying that "Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter."[2]Strix reports that the flaw is rated 4.3 out of 10 on the CVSS scale, which counts as medium severity[3]. The Hacker News lists a CVSS score of 5.3[4] instead.SentinelOne says the attacker gets the same network access as the Plex server, because the server makes the request[5]. The firm adds that this allows scanning of internal services and, on AWS, Azure or GCP hosts, retrieval of cloud instance metadata[5].According to The Hacker News, the flaws were disclosed to Plex on July 27, 2026, by researcher Zach Main and patched in version 1.43.3.10861, released August 3[4].The Hacker News reports that attackers tried to exploit the flaws in the wild one day after technical details of the "Plex2Shell" chain went public on October 16[4]. The outlet says the attacks delivered "myawesomeproxy," which VirusTotal identifies as a stealthy Linux backdoor and reverse proxy[4], along with an XMRig miner process called "mylovelyminer"[4].A DEV Community analysis says a ZoomEye search found 507,974 Plex Media Server assets[6] and advises admins to "Upgrade to 1.43.3.10861 or later and verify the running version afterwards."[6]