CVE-2026-96652 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-23

Added to CISA KEV: 2026-10-20 27 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE: Upgrade Plex Media Server to version 1.43.3.10861 or later — this is the only complete remediation.
URGENT: Check whether your Plex instance is internet-facing by verifying router port forwarding rules (TCP 32400) and UPnP settings. If internet exposure is not required, disable 'Plex Remote Access' in Settings > Remote Access and block port 32400 at the firewall.
INVESTIGATE FOR COMPROMISE: If your Plex server was internet-accessible prior to patching, review Plex server logs for unexpected outbound connections from the /player/timeline endpoint. Check for unauthorized processes (crypto miners, unfamiliar binaries) on the host system, particularly on Linux hosts where the Plex2Shell chain has been observed deploying malware.
NETWORK MITIGATION: Implement strict outbound firewall rules on the host machine to block unauthorized POST requests originating from the Plex Media Server process. This limits SSRF impact even on unpatched systems.
NETWORK MITIGATION: If remote access is required, place Plex behind a reverse proxy (e.g., nginx, Traefik) or VPN rather than exposing port 32400 directly to the internet. This adds an authentication layer and reduces the attack surface.
MONITORING: Set up alerts for unexpected outbound HTTP/HTTPS connections from the Plex process, particularly to non-Plex infrastructure. Monitor for high CPU usage indicative of crypto mining activity.
PATCH PRIORITY: HIGH — Active exploitation in the wild via the Plex2Shell chain elevates this beyond the CVSS 4.3 score. Prioritize patching all internet-exposed Plex instances immediately. LAN-only instances should be patched within normal patch cycles (within 30 days).
NOTE ON CHAINING: The Plex2Shell chain elevates this vulnerability's effective severity to critical on internet-facing instances. Do not assess risk based solely on the CVSS 4.3 standalone SSRF score.

🔍 Web Intelligence (Kagi · 2026-10-20)

Summary

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plex Media Server that allows unauthenticated attackers to force the server to send unauthorized POST requests to arbitrary destinations. The vulnerability exists within the `/player/timeline` endpoint, where insufficient validation of the "protocol" parameter allows it to be injected into a programmatically constructed player URL. This flaw is significant because it can serve as a critical component in broader exploit chains—such as the "Plex2Shell" vulnerability chain—enabling attackers to perform further malicious actions, including the installation of crypto miners or other unauthorized software on the host system.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, with threat actors weaponizing it as part of the "Plex2Shell" exploit chain shortly after technical details and proof-of-concept (PoC) code were made public in mid-October 2026.
Threat Actors/Campaigns: Attackers have been observed using the vulnerability to gain initial access for follow-on activities, specifically the deployment of crypto miners and various Linux-based malware.
Availability: Technical write-ups and functional PoC exploit code were released publicly on October 16, 2026.
Prerequisites:

* Network: Exploitation is network-based, targeting internet-facing Plex instances. * Authentication: The vulnerability is exploitable without authentication, as attackers can utilize any `X-Plex-Token` value to interact with the target endpoint. * User Interaction: No user interaction is required for a successful attack.

Affected Products & Patches

Affected Versions: All versions of Plex Media Server prior to 1.43.3.10861.
Patch Availability: The vulnerability was addressed by the vendor in Plex Media Server version 1.43.3.10861. Users are strongly advised to upgrade to this version or higher.
Mitigations:

* Restrict access to the `X-Plex-Token` header to ensure only authenticated, trusted clients can interact with the server. * Implement strict outbound network restrictions or firewall rules on the host machine to block unauthorized POST requests originating from the Plex Media Server process.

Impact

Access & Capability: Successful exploitation allows an attacker to abuse the server as a proxy to conduct SSRF attacks, potentially bypassing internal network security controls or interacting with internal-only services. When combined with other vulnerabilities (as in the Plex2Shell chain), it enables Remote Code Execution (RCE) and full system compromise.
Business Risk: For internet-facing deployments, this vulnerability presents a high risk of total server takeover. Compromised servers are being leveraged for malicious resource-intensive tasks, such as crypto mining, and can be used as a beachhead to infiltrate the broader internal network infrastructure.