CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026. The vulnerability affects Plex Media Server and is a server-side request forgery (SSRF) flaw that can make the server send a POST request to a destination chosen by an attacker.
The flaw allows an attacker using any X-Plex-Token value to supply a full URL in the “protocol” parameter, causing the server to make the request. It can be chained with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The supplied CVSS score is 5.3, rated Medium. Patch status is unknown; Plex has published a security update notice for Media Server version 1.43.2 and earlier, but the available data does not confirm whether a patch is available.
KEV inclusion indicates that CISA has confirmed active exploitation. Use in ransomware campaigns is unknown. Federal agencies must remediate by 3 November 2026.
CISA requires organisations to apply mitigations in accordance with vendor instructions, while complying with BOD 26-04 guidance on prioritising security updates and CISA’s Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance; discontinue use of the product if mitigations are unavailable. FCEB agencies are directly subject to CISA’s requirements. All organisations should review their Plex Media Server exposure, assess internet-facing assets and follow applicable patching guidance.
For full details, see the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96652) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).