medium Known exploitedREV. 01
CVE-2026-96655Plex Media Server — Transcode Path Request Forgery
A server-side request forgery (SSRF) flaw in Plex Media Server before 1.43.3.10861 lets an authenticated user make the server request arbitrary internal or external addresses through the transcode path. It can be chained with three other Plex flaws.
Read the risk
THE VITAL STATS- CVSS score
- 5.3/ 10 CVSS v4.0
- EPSS probability
- 1.6% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2026-09-23
- Added to KEV
- 2026-10-20
- CISA due date
- 2026-11-03
- Exploit published
- Not recorded
- Confidence
- high
- Kill chain
- unclassified
- MITRE ATT&CK
- —
- Severity
- medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needsAn authenticated user account on the Plex Media Server.
Fixed in1.43.3.10861
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Writeupraw.githubusercontent.comraw.githubusercontent.com
- 04Writeupcve.orgcve.org
- 05Writeupzmain.infozmain.info
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, published_at, references | nvd.nist.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-05 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
History unavailable — this build has no Git history for the card file.