CVE-2026-96655 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-23

Added to CISA KEV: 2026-10-20 27 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE: Upgrade Plex Media Server to version 1.43.3.10861 or later — this is the only complete remediation given active exploitation of the Plex2Shell chain in the wild
URGENT MITIGATION: If patching is not immediately possible, restrict external access to Plex port 32400 via firewall rules. Disable Plex Remote Access in Settings > Remote Access until patched
NETWORK SEGMENTATION: Ensure Plex server is not on the same network segment as sensitive internal resources (databases, NAS admin interfaces, cloud metadata endpoints) to limit SSRF pivot potential
IOC REVIEW: Examine Plex server access logs for anomalous requests to /video/:/transcode/universal with unexpected URL parameters, particularly targeting internal RFC-1918 addresses (10.x, 172.16.x, 192.168.x) or cloud metadata IP 169.254.169.254
CLOUD DEPLOYMENTS: If running Plex on a cloud VM (AWS/GCP/Azure), verify that the cloud metadata endpoint (169.254.169.254) is not reachable from the Plex process, or apply IMDSv2-only restrictions (AWS) to prevent credential theft via SSRF
SHODAN EXPOSURE CHECK: Search Shodan for your public IP on port 32400 to determine if your instance is directly internet-discoverable
PATCH PRIORITY: CRITICAL — treat as critical despite the 4.3 CVSS score due to active exploitation of the chained Plex2Shell attack enabling unauthenticated RCE. Apply within 24-48 hours for all internet-accessible deployments
POST-PATCH: Rotate any credentials or API tokens that may have been accessible to the Plex service process, particularly if running on cloud infrastructure where metadata credential theft via SSRF is possible

🔍 Web Intelligence (Kagi · 2026-10-20)

Summary

CVE-2026-96655 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plex Media Server that allows an authenticated user to force the server to send requests to arbitrary internal or external network addresses via the `/video/:/transcode/universal` endpoint ^[4]^[6]. While rated individually as a medium-severity issue, this vulnerability is significant because it is a critical component of the "Plex2Shell" exploit chain, which can be combined with other vulnerabilities (CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656) to achieve unauthenticated remote code execution with the privileges of the Plex service ^[1]^[2].

Exploitation

Active Exploitation: There are reports of the "Plex2Shell" exploit chain being weaponized and used in the wild shortly after disclosure ^[1]^[5].
Availability: Proof-of-concept (PoC) code for the Plex2Shell chain is available on public platforms such as GitHub ^[5].
Attack Prerequisites:

* Individually, CVE-2026-96655 technically requires an authenticated session ^[3]. * However, as part of the weaponized Plex2Shell chain, researchers have demonstrated that the vulnerability can be exploited by unauthenticated remote attackers to achieve full system compromise ^[1]^[2].

Affected Products & Patches

Affected Versions: Plex Media Server versions prior to 1.43.3.10861 ^[4]^[6].
Patch Availability: Users are advised to upgrade to Plex Media Server version 1.43.3.10861 or later to remediate these vulnerabilities.
Mitigations: Restricting access to the Plex Media Server interface—particularly ensuring it is not exposed directly to the public internet—can help mitigate risk until updates are applied.

Impact

Access Capability: Successful exploitation allows an attacker to send requests to internal network resources (bypassing firewalls) or external addresses, and when chained, facilitates remote code execution (RCE) with the privileges of the underlying Plex service ^[1]^[3].
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it provides a pathway for threat actors to pivot into private local networks, exfiltrate sensitive data, or gain persistent control over the host server.

Sources

Plex2Shell Exploit Chain (CVE-2026-96652, CVE-2026-96654, CVE-2026 ...
The vulnerabilities are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These flaws allow an unauthenticated remote attacker to run code with the same privileges as the Plex service. The vulnerabilities were reported to Plex on July 27, and the company confirmed them a…
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After ...
Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. The code runs with the same privileges as the Plex service. The issues were reported to Plex on July 27, and the company confi…
CVE-2026-96655 - Vulnerability Details - OpenCVE
The attack requires an authenticated session, so privilege escalation or credential compromise is a prerequisite. Internally authenticated users can reach internal addresses, while external addresses are also possible, broadening the potential for lateral movement or data leakage. Generated by OpenC…
CVE-2026-96655: Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' ...
Post
Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers PoC: github.com/code-zm/plex2s… A security researcher says ...

🔴 CVE-2026-96655