compromised.live Free. No login.
Feed / CVE-2026-96655Also as JSON
WATCHExploited vulnerability Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

What's happening and what to do

An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

  1. 2026-10-20Added to CISA's Known Exploited Vulnerabilities catalog.
  2. 2026-11-03Federal patch deadline for US agencies.
  3. 2026-11-03 21:55First seen here.

Source text

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.