CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026. The vulnerability affects Plex Media Server and is a server-side request forgery (SSRF) flaw that could let an authenticated user make the server request arbitrary internal or external addresses.
The flaw is triggered through the `/video/:/transcode/universal` path parameter. SSRF can allow requests to be made from the server to destinations selected by the user, including internal addresses. The issue can also be chained with CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656. NVD rates it CVSS 5.3, Medium. Patch status is listed as unknown in the supplied data; Plex’s security update notice provides vendor information for Media Server v1.43.2 and earlier.
CISA’s KEV listing indicates that exploitation has been confirmed. The available data does not establish whether the vulnerability has been used in ransomware campaigns. CISA has set 3 November 2026 as the remediation deadline. Organisations should treat the entry as a known exploited vulnerability and assess affected deployments against that deadline.
CISA requires organisations to apply mitigations in accordance with vendor instructions and comply with the relevant BOD 26-04 guidance, including its Forensics Triage Requirements. Where mitigations are unavailable, the required action is to follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s requirements. All organisations should review their Plex Media Server exposure, assess internet-facing assets and follow applicable patching guidance.
For full details, consult the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96655) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).