CISA KEV Alert: Plex Media Server SSRF vulnerability

Summary: CISA has issued an alert regarding an actively exploited Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-96652) in Plex Media Server. This flaw allows attackers to force the Plex server to send a POST request to a chosen destination and can be chained with other vulnerabilities.

A critical SSRF vulnerability (CVE-2026-96652) has been identified in Plex Media Server, and CISA has announced that it is actively exploited in the wild. SSRF is a security flaw where a server is coerced into sending requests to another resource, either on the internal network or the internet.

This vulnerability relies on an attacker, possessing any X-Plex-Token value, injecting a full URL into the protocol parameter to force the Plex server to send a POST request to their chosen destination. This could lead to the server targeting other services on the internal network or exfiltrating data.

All users and system administrators running Plex Media Server need to take immediate action against this vulnerability. Internet-facing Plex servers, in particular, pose a high risk for such attacks, potentially leading to severe consequences like internal network access or data exfiltration.

Applying patches quickly is critically important. Additionally, considering extra security measures like network segmentation to isolate Plex servers and restricting outward-facing ports should be a priority.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar