CVE-2026-96655: listed in the CISA KEV catalog

CVE-2026-96655 · CVSS 4.3 MEDIUM · EPSS 11% · KEV 2026-10-20 · patch available

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Is CVE-2026-96655 exploited?

• Listed in the CISA KEV catalog on 2026-10-20.
• Federal remediation due 2026-11-03.
• Past that date by 3 days.
• EPSS puts exploitation in the next 30 days at 11%.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• Plex · Media Server · >= 0, < 1.43.3.10861

Is there a patch?

Yes. Update to one of these or later:

From Plex's CVE record

What PlainSec published about CVE-2026-96655

• Plex2Shell puts QNAP NAS storage at risk (2026-11-06)
• PHP2Shell draws millions of attempts, but no success observed (2026-10-27)
• Exploitation spans Plex, Siemens, SiteGuard and a separate ClickFix lure (2026-10-21)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-11-06.