CVE-2026-96655: Plex Media Server

What is CVE-2026-96655?

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

CVSS4.3 NVD 3.1

SeverityMEDIUM

Exploitation In the wild

EPSS<1% · P12

Triage statusActive Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWECWE-918

NVD published2026-09-23

NVD last modified2026-09-29

Timeline

2026-09-23Published to the U.S. National Vulnerability Database (NVD)
2026-09-29NVD record last updated
2026-10-20First covered in a defend.network daily briefing

Affected product

Plex Media Server

References

Referenced in our briefings & reports

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits (2026-10-20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.

What is CVE-2026-96655?

Timeline

Affected product

References

Referenced in our briefings & reports

Get Critical CVE Alerts