Server-Side Request Forgery (SSRF) Vulnerability in Plex Media Server

Summary: CISA has warned about an actively exploited SSRF vulnerability (CVE-2026-96655) in Plex Media Server. This flaw allows an authenticated user to send requests to arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path.

A critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-96655) allowing authenticated users to perform SSRF has been discovered in Plex Media Server. This flaw is listed in the CISA KEV catalog and is actively being exploited, posing a serious threat to the internal network security of Plex servers.

An SSRF vulnerability occurs when an application sends a request to a URL controlled by an attacker. Specifically for Plex, an authenticated user can send requests to other internal systems within the network where the Plex server resides, or to arbitrary external addresses, via the ‘/video/:/transcode/universal’ path parameter. This provides a pivot point for internal network scanning, port scanning, or exploiting other internal services.

In live systems, exploiting this vulnerability can be used to gain access to other systems within the network where the Plex server is located. An attacker could thereby reach sensitive services on the internal network, discover systems behind firewalls, or chain it with other vulnerabilities to execute a broader attack. The fact that this vulnerability can be chained with other Plex flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96656) increases the risk level.

Plex Media Server administrators must immediately apply vendor-released updates and review their server’s network segmentation. Furthermore, Plex servers should be run with the principle of least privilege and isolated from other critical systems on the internal network.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar