CVE-2026-96652: Plex Media Server exploitation alert

CVE-2026-96652: what changed

CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-10-20. Inclusion indicates evidence of exploitation; it does not establish that your own systems have been compromised.

Affected product

Plex Media Server. Confirm affected versions against the vendor advisory.

CISA description

Plex Media Server contains a server-side request forgery SSRF vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Recommended response

Inventory affected deployments, check vendor guidance for fixes or mitigations, and verify the update was applied. Review available logs and incident-response guidance when exploitation is suspected.

Catalog context

CISA lists a remediation due date of 2026-11-03. Federal directive deadlines have a defined scope; other organizations should prioritize according to their exposure and risk. Ransomware campaign use is listed as unknown; “unknown” does not mean exploitation is absent.

Sources

• CISA Known Exploited Vulnerabilities catalog
• CVE-2026-96652 reference

Automated security brief based on CISA catalog data. Catalog addition date: 2026-10-20.