CVE-2026-96655
Plex Media Server
What this is
Plex Media Server lets a signed-in user make the program send requests to internal or external addresses of their choice.
How it can harm you
Someone who can sign in and reach the program over a network could make it contact internal or external addresses. This could expose some information, but exactly what could be revealed is unknown.
How urgent it is
This vulnerability is already being used in attacks. Update to prevent signed-in users from misusing the program to contact addresses of their choice.
Who is affected
Plex Media Server versions before 1.43.3.10861 are affected.
What to do
Update Plex Media Server to 1.43.3.10861, which fixes the problem.
How to check your server
Check the installed version of Plex Media Server and compare it with the affected and fixed releases in the advisory from Plex.
Technical details
- CVE
- CVE-2026-96655
- Published
- September 23, 2026
- CWE
- CWE-918
- CVSS
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.5% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.