Source: cisa.gov
Plex Media Server contains a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96655. An authenticated user can exploit this flaw to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. The vulnerability affects Plex Media Server v1.43.2 and earlier. It can be chained with related vulnerabilities CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, potentially increasing the severity and impact. The vulnerability has been flagged under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensic triage requirements are also noted under BOD 26-04 implementation guidance. Users are urged to apply the security update as detailed in the Plex community forums.
