CVE-2026-96652
Plex Media Server
What this is
Plex Media Server can be tricked into sending a request to a destination chosen by an attacker.
How it can harm you
An attacker who can reach the program over the network and supply any token value can make your server send a request to a destination they choose. What information this could expose is not specified.
How urgent it is
This vulnerability is already being used in attacks. Update the program to prevent attackers from using this flaw on your server.
Who is affected
Plex Media Server versions before 1.43.3.10861 are affected.
What to do
Update Plex Media Server to 1.43.3.10861, which fixes this flaw.
How to check your server
Find the installed Plex Media Server version and compare it with the affected and fixed releases in the vendor advisory.
Technical details
- CVE
- CVE-2026-96652
- Published
- September 23, 2026
- CWE
- CWE-918
- CVSS
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.5% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.