Plex Media Server flaw is being exploited: apply vendor fixes now
CISA says attackers are exploiting a server-side request forgery flaw (CVE-2026-96652) in Plex Media Server. Plex users should apply the vendor's mitigations and check whether their server is exposed to the internet.
What it is: Plex Media Server has a server-side request forgery (SSRF) flaw, tracked as CVE-2026-96652. It lets an attacker make the Plex server send a request to a destination the attacker chooses. The attacker only needs any token value of the kind Plex uses to identify clients.
This flaw can be chained with three other flaws: CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chaining can make the combined impact worse than this flaw alone.
Who is affected: People and organizations that run Plex Media Server. The facts we have do not list the affected or fixed versions, so check Plex's advisory for those details.
Is it being exploited: Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-20 because it has evidence of exploitation. We do not know whether ransomware groups are using it.
What to do: - Apply the mitigations and updates in Plex's instructions as soon as you can. - Check whether your Plex server is reachable from the internet, and reduce that exposure where you can. - Also look for fixes for the three related CVEs listed above. - If no mitigation is available, CISA advises stopping use of the product. - US federal agencies have a due date of 2026-11-03. Everyone else should treat that as a useful target. - Follow CISA's forensics triage guidance if you think your server may already have been targeted.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.