CVE-2026-96652: listed in the CISA KEV catalog

CVE-2026-96652 · CVSS 4.3 MEDIUM · EPSS 12% · KEV 2026-10-20 · patch available

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Is CVE-2026-96652 exploited?

• Listed in the CISA KEV catalog on 2026-10-20.
• Federal remediation due 2026-11-03.
• Past that date by 3 days.
• EPSS puts exploitation in the next 30 days at 12%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• Plex · Media Server · >= 0, < 1.43.3.10861

Is there a patch?

Yes. Update to one of these or later:

From Plex's CVE record

What PlainSec published about CVE-2026-96652

• Plex2Shell puts QNAP NAS storage at risk (2026-11-06)
• PHP2Shell draws millions of attempts, but no success observed (2026-10-27)
• Exploitation spans Plex, Siemens, SiteGuard and a separate ClickFix lure (2026-10-21)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-11-06.