CVE-2026-96652: Plex Media Server Player-Timeline SSRF (KEV)

CVE-2026-96652 is a server-side request forgery in Plex Media Server's /player/timeline endpoint that lets an attacker with any X-Plex-Token value force the server to POST to an attacker-chosen destination, and Plex and CISA both flag it as one of four fixed flaws that can be chained together for unauthenticated remote code execution on unpatched servers.

CVE-2026-96652 is a server-side request forgery (CWE-918) in Plex Media Server. NVD's description states it "allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination" (NVD).

Plex's own forum advisory frames this as one of four related, separately-numbered flaws fixed in the same release — CVE-2026-96652 (this SSRF), CVE-2026-96654 (access to internal agent functions over the loopback interface), CVE-2026-96655 (disclosure of the server owner's admin token), and CVE-2026-96656 (arbitrary file write to the Codecs directory via transcoder preferences) — and states that, chained together, they let "an unauthenticated attacker run code with the privileges of the Plex Media Server process" (Plex security forum post).

NVD lists CVE-2026-96652 with status "Analyzed" and a CVSS v3.1 base score of 4.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, and an alternate CVSS v4.0 score of 5.3; taken alone this individual SSRF has limited impact (confidentiality-only, low), consistent with its role as one link in the larger exploit chain rather than the chain's most severe component (NVD).

Plex fixed all four chained issues in Plex Media Server 1.43.3.10861, which supersedes all versions up to and including 1.43.2 (Plex security forum post).

CISA added CVE-2026-96652 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20, with a required-action due date of 2026-11-03; the KEV entry notes the vulnerability "can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656" (CISA KEV). Plex's post describes a public proof-of-concept for the full chain released around 2026-10-16 and reports the chain being "actively and widely exploited," including compromised servers repurposed for cryptocurrency mining and proxy operations (Plex security forum post).

As of 2026-10-27, FIRST scores the probability of exploitation for this specific CVE at 0.01821 (78.641th percentile) — modest for this one component, but it should be read alongside the chain's real-world RCE impact rather than in isolation (FIRST EPSS).

Any internet-reachable Plex Media Server on 1.43.2 or earlier should be updated to 1.43.3.10861 or later immediately, since this flaw is only exploitable as part of a chain that Plex and CISA both describe as already weaponized.

• SSRF via /player/timeline: an attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to an attacker-chosen destination. — NVD
• One of four related CVEs (96652/96654/96655/96656) fixed together; chained, they let an unauthenticated attacker run code with the privileges of the Plex Media Server process. Fixed in 1.43.3.10861. — Plex security forum post
• CVSS v3.1 base score 4.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; alternate CVSS v4.0 score 5.3. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-20, due date 2026-11-03, noting it can be chained with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. — CISA KEV
• EPSS score is 0.01821 (78.641th percentile) as of 2026-10-27. — FIRST EPSS