What happened
An active exploitation of a server-side request forgery (SSRF) vulnerability has been reported in Plex Media Server. This vulnerability, identified as CVE-2026-96655, allows authenticated users to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. The flaw has been confirmed to be exploited in the wild, posing significant risks to affected deployments. The vulnerability is associated with CWE-918 and can be chained with other CVEs, including CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, potentially amplifying the impact. The vulnerability's exploitation path involves authenticated access to the server, where an attacker leverages the SSRF flaw to request arbitrary network resources. This can lead to further compromise or information disclosure if successfully exploited. The issue is critical in severity and necessitates prompt mitigation measures. The incident underscores the importance of timely patching and adherence to security guidance, especially given the active exploitation observed.
Who is affected
Organisations running Plex Media Server are affected by this vulnerability. Any deployment with the vulnerable component exposed to authenticated users may be at risk, depending on the specific access controls in place. The vulnerability's exploitation relies on user authentication, but the potential for chaining with other CVEs could increase impact. Due to the active exploitation, all affected deployments are advised to review exposure levels and implement mitigations as soon as possible.
Recommended actions
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s Forensics Triage Requirements.
- Evaluate each deployment's internet exposure and environment to determine mitigation applicability. Discontinue use of the product if mitigations are unavailable or inadequate.
- Monitor for further guidance from vendor security advisories and updates related to this vulnerability.
