# CVE-2026-96655: Plex Media Server - SSRF

> Live exploitation tracking for CVE-2026-96655 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-96655

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Plex Media Server
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application

## Description

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

## CrowdSec analysis

[CVE-2026-96655](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-96655) is a server-side request forgery vulnerability in Plex Media Server before 1.43.3.10861. The universal transcoder accepts an HTTP URL in its `path` parameter and fetches it without a host allowlist, letting an authenticated user make the server request arbitrary internal or external addresses. It is one of the steps of the Plex2Shell exploitation chain.

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-96655 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send requests to `/video/:/transcode/universal/start` (or `start.m3u8`, `decision`) with an attacker-chosen URL in the `path` query parameter, e.g. `path=http://169.254.169.254/latest/meta-data/`, instead of a library path.

## Timeline

- 2026-09-23: CVE Published. CVE-2026-96655 is published to NVD.
- 2026-10-20: CISA KEV. CVE-2026-96655 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-10-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-96655 exploitation attempts against the CrowdSec Network.
- 2026-11-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://zmain.info/blog/plex2shell
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-96655

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-96655) follows observed exploitation activity for CVE-2026-96655. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.