--- id: "CVE-2026-96655" kind: "vulnerability" aliases: ["CVE-2026-96655"] title: "Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external\u2026" severity: "high" cvss: 5.3 epss: null exploited: true status: "open" category: "runtime" products: [{"name": "Plex Media Server", "fixed": ["1.43.3.10861"], "affected": "< 1.43.3.10861", "ecosystem": "vendor"}, {"name": "Plex Media Server", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["docker", "exploited", "media-server", "nas", "plex", "rce-chain", "runtime", "self-hosted", "ssrf", "vendor"] not_affected_if: ["no-authenticated-users", "no-remote-access", "patched-1.43.3.10861"] published_at: "2026-09-23T17:17:23+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:43:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external… Plex Media Server before 1.43.3.10861 has an authenticated SSRF in /video/:/transcode/universal (CVE-2026-96655, CVSS 4.0 5.3 medium alone). It is one of four bugs chained as Plex2Shell (CVE-2026-96652, -96654, -96655, -96656) into unauthenticated remote code execution. A public PoC has existed since Oct 16 and exploitation in the wild started Oct 17: cryptominers and proxy software on compromised servers. CISA added it to KEV on Oct 20 (due Nov 3). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Plex Media Server affected < 1.43.3.10861 fixed 1.43.3.10861 - vendor:Plex Media Server affected ? fixed ? ## How to check In Plex Web go to Settings > General and read the server version; anything below 1.43.3.10861 is affected. Signs of compromise: Plex-spawned processes you do not recognize (myawesomeproxy, mylovelyminer, x12345), unfamiliar .so or .dll files in the Plex Codecs folder, transcoder options in Preferences.xml you did not set, outbound connections to proxystream.st, or high CPU while idle. ## Fix Update to Plex Media Server 1.43.3.10861 or later (released Aug 4). On NAS the package manager may lag, so install the package manually. Docker users should pull the current pms-docker image. If the server was internet-reachable on an older version, assume it is compromised: rebuild from a clean install, empty the Codecs folder, sign out all devices, change the Plex password, and treat anything the Plex service account could reach as exposed. If you do not need remote access, turn it off and do not forward port 32400. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655 - 2026-10-23T22:43:12+00:00 analyst — Primary: Plex forum security post (updated Oct 19) says 1.43.3.10861+ is fixed and exploitation is active; CVE record says affected before 1.43.3.10861. Sources disagree on what this CVE covers: Plex's forum table labels 96655 as admin-token disclosure, while CVE, BleepingComputer and SentinelOne call it the authenticated transcode SSRF; I used the CVE wording. Check Point's CPAI-2026-15176 says 'prior to 1.43.0.10861', which looks like a typo and was not used. PoC link not read (Zach Main, published Oct 16/19 per BleepingComputer); poc_count not set. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96655 ## Documents - [advisory] CVE Record: CVE-2026-96655 https://www.cve.org/CVERecord?id=CVE-2026-96655 - [advisory] CISA adds six KEVs (Oct 20, 2026) https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog - [describes] CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/ - [discussion] Operator reports NAS compromised by Plex2Shell https://x.com/_master117/status/2113722829476626681 - [fix] Plex: Important Security Update for Plex Media Server v1.43.2 and earlier https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 - [poc] Plex2Shell write-up (Zach Main) https://zmain.info/blog/plex2shell - [poc] code-zm/plex2shell exploit code https://github.com/code-zm/plex2shell ## From the sources Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_