Plex Media Server flaw is being exploited: apply vendor fixes now
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96655) that lets a logged-in user make the server send requests to addresses of their choosing. Plex users should follow the vendor's instructions to fix or mitigate it.
What it is: Plex Media Server has a server-side request forgery (SSRF) flaw, tracked as CVE-2026-96655. A logged-in user can make the server request internal or external addresses they choose, through a video transcoding path.
Why it matters: The flaw can be chained with three other issues, CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656. Combined, they may allow more serious harm than this flaw alone. Check the vendor's advisory for details on those issues.
Is it being exploited: Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-20 because it has evidence of exploitation. Whether ransomware groups are using it is unknown.
Who is affected: People who run Plex Media Server. The facts we have do not list affected versions, so check the vendor's advisory to see if your version is affected.
What to do: - Apply the mitigations and updates in Plex's instructions as soon as you can. - Check whether your server is reachable from the internet, and limit access if it does not need to be. - Review who has accounts on your server and remove any you do not recognize. - If no fix or mitigation is available for your setup, CISA advises stopping use of the product. - US federal agencies have a deadline of 2026-11-03. CISA also asks for forensic triage, so look for signs of unusual activity on affected servers.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.