External risk intelligence

Plex Media Server Authenticated SSRF Vulnerability

CVE advisoryKnown Exploit

CVE-2026-96655

Plex Media Server is commonly deployed as an internet-facing media streaming service or edge-accessible application. While the vulnerability requires authentication, the product's primary role as a server intended for remote media access makes it a frequent candidate for internet-facing configurations, placing it within the category of likely accessible services.

Server-Side Request Forgery

Plex Media Server

before 1.43.0.10861

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in Plex Media Server could allow an authenticated user to access internal or external network resources. This could potentially expose sensitive information or allow unauthorized actions within the network. The primary concern is to confirm if this technology is in use and if it is exposed externally.

Authenticated users can access unintended network locations.
It impacts systems designed for remote media access.
Confirm relevance and exposure to internal/external resources.

Attack Path

How an attacker could exploit the issue

An authenticated user can trigger this vulnerability by making a specific request to the Plex Media Server. This request involves manipulating a path parameter within the `/video/:/transcode/universal` endpoint. If successful, an attacker could potentially trick the server into requesting arbitrary internal or external network addresses.

Requires authenticated user access.
Triggered via a path parameter.
Risk: Arbitrary network address requests.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could leverage this vulnerability to cause the Plex Media Server to make requests to arbitrary network addresses. This could potentially expose information about the server's internal network environment or allow interaction with external services. The risk depends on the server's network access and the specific addresses it can reach.

Server's internal network information.
Server makes unauthorized network requests.
Potential for further system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

As an authenticated app assistant, I must adhere strictly to the provided context and rules. The context indicates Plex Media Server is the affected technology. Therefore, the teams likely responsible for this CVE are those managing Plex deployments and the authentication infrastructure. The first practical move is to identify all instances of Plex Media Server, confirm their reachability and business criticality, identify the accountable owner for each instance, and then prioritize remediation based on that risk assessment.

Plex application and infrastructure owners.
Verify all Plex Media Server instances.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Plex Media Server?

Plex Media Server is a software application used to organize and stream personal media collections, such as videos, music, and photos, to various client devices. It is designed to act as a central hub for media, often facilitating remote access so users can stream their content from anywhere.

What is the vulnerability in CVE-2026-96655?

This CVE involves a weakness known as Server-Side Request Forgery (SSRF), identified as CWE-918. It allows a user who has authenticated to the server to manipulate specific path parameters. This manipulation tricks the server into making network requests to arbitrary internal or external addresses that it would not normally access.

How is the vulnerability triggered?

An authenticated user triggers the bug by sending a crafted request to the '/video/:/transcode/universal' endpoint of the media server. The issue does not occur with unauthorized or unauthenticated requests, as the server first validates the user session before processing the path parameter that contains the malicious address.

Is my Plex server at risk?

According to Halo Surface Signal, this software is frequently deployed as an internet-facing service to enable remote media streaming. Because the server is intended to be accessible, it is a likely candidate for being reachable from the internet. You should evaluate whether your specific instance is exposed to external networks versus restricted to internal use.

How do I respond to CVE-2026-96655?

Begin by creating an inventory of all Plex Media Server instances within your environment. Identify the owners for each deployment and verify their network reachability. Once identified, prioritize these instances based on their risk and exposure levels, and prepare to apply the necessary software updates provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.