Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96655)

The primary remediation is to upgrade to the patched version provided by the vendor.

1. Update Server

Navigate to 'Settings > Server > General' in the Plex Web UI to check for updates, or manually download the latest version from the Plex official website.

2. Temporary Network Mitigation

If immediate patching is not possible, implement egress filtering to prevent the Plex process from reaching sensitive internal addresses.

# Example: Block access to AWS/GCP Metadata Service on Linux
iptables -A OUTPUT -d 169.254.169.254 -j DROP

3. Monitoring

Audit server logs for unusual activity involving the /video/:/transcode/universal endpoint, specifically looking for external URLs passed as parameters.

CVE-2026-96655 is a Server-Side Request Forgery (SSRF) vulnerability identified in the /video/:/transcode/universal path parameter of Plex Media Server. An authenticated user can manipulate this parameter to force the server to initiate requests to arbitrary internal or external IP addresses. This vulnerability is particularly dangerous as it is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and maintains a high EPSS score (0.94), indicating active exploitation in the wild. Attackers can leverage this to pivot into internal networks, scan for local services, or exfiltrate sensitive cloud instance metadata (IMDS) which may contain temporary security credentials.