CVE-2026-96655: Plex Media Server SSRF / Admin-Token Disclosure (KEV)

CVE-2026-96655 is a server-side request forgery in Plex Media Server's video transcode endpoint that an authenticated user can use to request arbitrary internal or external addresses, and Plex says it is one of four chained CVEs that let an unauthenticated remote attacker ultimately run code as the Plex Media Server process; it is on the CISA KEV catalog and has already been used in widespread cryptomining and proxyware attacks.

CVE-2026-96655 is a Server-Side Request Forgery (CWE-918) in Plex Media Server. NVD's Analyzed description states that Plex Media Server before 1.43.3.10861 "allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter" (NVD).

NVD has not published its own independent CVSS score for this CVE; the only score on record is the CNA-submitted Secondary rating of CVSS v3.1 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, medium-low on its own) and CVSS v4.0 5.3, so the figure shown here is not NVD-confirmed — it reflects the reporting CNA's assessment of this one CVE in isolation, not the combined severity of the exploit chain described below (NVD).

Plex's own security-forum post (2026-10-19, updated 2026-10-20) describes CVE-2026-96655 in its CVE table as "Disclosure of the server owner's admin token," and states that, chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656, "these issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process." Plex confirms a public proof-of-concept was released on 2026-10-16 and that, since then, it has seen "widespread attacks against internet-facing servers that haven't been updated," with compromised servers used to run cryptocurrency miners and proxy software. Plex Media Server 1.43.3.10861 and later are not affected (Plex security forum post).

CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20, with a required-action due date of 2026-11-03, and its own short description notes this CVE "can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656" — consistent with Plex's own account (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0164 (76.211th percentile) for this individual CVE — lower than the chain's real-world impact would suggest, since EPSS scores each CVE independently rather than as part of a combined exploit path (FIRST EPSS).

Any internet-facing Plex Media Server older than 1.43.3.10861 should be treated as potentially compromised: Plex recommends updating immediately, checking for unrecognized processes or files in the Codecs folder, and rebuilding from a clean install rather than reusing the existing Plex data directory if compromise cannot be ruled out.

• Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter (SSRF, CWE-918). — NVD
• No NVD-published independent score exists; only a CNA Secondary rating is on record (CVSS v3.1 4.3, v4.0 5.3) — shown as not NVD-confirmed. — NVD
• Plex's own CVE table describes CVE-2026-96655 as disclosure of the server owner's admin token; chained with CVE-2026-96652/96654/96656 it lets an unauthenticated remote attacker run code as the Plex Media Server process; PoC public since 2026-10-16; widespread cryptomining/proxyware attacks since; fixed in 1.43.3.10861. — Plex security forum post
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-20, required-action due date 2026-11-03, chainable with three related Plex CVEs per CISA's own description. — CISA KEV
• EPSS score is 0.0164 (76.211th percentile) as of 2026-10-27. — FIRST EPSS