What happened
A critical vulnerability has been identified in Plex Media Server, classified as CVE-2026-96652. This weakness involves a server-side request forgery (SSRF) vulnerability, which has been actively exploited in the wild. The flaw allows an attacker, using any valid X-Plex-Token, to include arbitrary URLs in the 'protocol' parameter. This enables the attacker to force the affected server to send POST requests to designated destinations, potentially leading to further malicious activities. The vulnerability’s exploit chain can also be combined with other CVEs, namely CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, increasing its impact. Exploitation relies on the attacker’s ability to craft specific requests exploiting the SSRF flaw, highlighting the need for swift mitigation. The vulnerability stems from the component's failure to properly validate or sanitise user-supplied URL inputs, classified under CWE-918.
Who is affected
Organisations running affected deployments of Plex Media Server are at risk, especially those with internet-facing instances that do not have adequate access controls. Systems that permit external or unauthenticated requests to the server could be more vulnerable to exploitation. Since the vulnerability is actively being exploited, organisations with publicly accessible Plex Media Server instances should consider their exposure carefully. All affected environments should assess their network and service configurations to prevent potential attack pathways based on this SSRF flaw.
Recommended actions
- Apply mitigations in accordance with the instructions provided by the vendor, ensuring compliance with CISA’s BOD 26-04 guidance for prioritising security updates based on risk.
- Review and implement relevant controls to restrict external access to the affected deployment, especially focusing on network ingress points capable of receiving crafted requests.
- Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if effective mitigations are not available.
- Regularly evaluate internet exposure of deployments and ensure adherence to associated patching and security guidelines, prioritising those facing the internet.
