SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
18 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-96652 · CVE-2026-96654 · CVE-2026-96655 · CVE-2026-96656 · CVSS 8.6

Plex Media Server: 4 flaws used in attacks; attackers can reach systems behind it

AFFECTSPlex Media Server

OFFICIAL NAMES: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability · Plex Media Server External Control of File Name or Path Vulnerability · Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 48 days old, so many systems are likely still unpatched. Ready-made attack tools are public.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    CVE-2026-96652 discussed publicly (CIRCL sighting). QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices.

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-96652 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 27 days after disclosure. CISA listed it 27 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 23, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. SEP 23, 2026
    CISA Vulnrichment marks CVE-2026-96652 as actively exploited
  2. Attack activity. SEP 23, 2026
    CISA Vulnrichment marks CVE-2026-96654 as actively exploited
  3. Attack activity. SEP 23, 2026
    CISA Vulnrichment marks CVE-2026-96655 as actively exploited
  4. Attack activity. SEP 23, 2026
    CISA Vulnrichment marks CVE-2026-96656 as actively exploited
  5. OCT 16, 2026
    6 public GitHub repositories claim a proof of concept for CVE-2026-96652
  6. OCT 18, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-96656
  7. Attack activity. OCT 19, 2026
    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (2 reports)
  8. Attack activity. OCT 19, 2026
    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
  9. Attack activity. OCT 19, 2026
    Plex Media Server External Control of File Name or Path Vulnerability
  10. OCT 21, 2026
    CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
  11. OCT 22, 2026
    Public proof of concept for CVE-2026-96652 (CIRCL sighting)
  12. OCT 26, 2026
    CVE-2026-96652 discussed publicly (CIRCL sighting) (12 reports, latest NOV 10)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell), NOV 1
  2. [2] nuclei-templates: Nuclei scan template: Plex Media Server < 1.43.3.10861 - SSRF via Transcoder, NOV 3
  3. [3] CIRCL Vulnerability-Lookup sightings: CVE-2026-96652 discussed publicly (CIRCL sighting), NOV 10
  4. [4] Security Affairs: QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices, NOV 9
  5. [5] CIRCL Vulnerability-Lookup sightings: CVE-2026-96656 discussed publicly (CIRCL sighting), NOV 6
  6. [6] CIRCL Vulnerability-Lookup sightings: Vulnerability CVE-2026-96655 confirmed by a researcher (CIRCL sighting), NOV 3
  7. [7] The Hacker News: CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws, OCT 21
  8. [8] CISA Known Exploited Vulnerabilities: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability, OCT 19
  9. [9] CISA Known Exploited Vulnerabilities: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability, OCT 19
  10. [10] CISA Known Exploited Vulnerabilities: Plex Media Server External Control of File Name or Path Vulnerability, OCT 19
  11. [11] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-96656, OCT 18
  12. [12] PoC-in-GitHub: 6 public GitHub repositories claim a proof of concept for CVE-2026-96652, OCT 16
  13. [13] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-96656 as actively exploited, SEP 23
  14. [14] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-96655 as actively exploited, SEP 23
  15. [15] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-96654 as actively exploited, SEP 23
  16. [16] CIRCL Vulnerability-Lookup sightings: 13 more reports
  17. [17] CISA Known Exploited Vulnerabilities: 1 more reports
  18. [18] CVE List V5 and CISA Vulnrichment: 1 more reports