CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability in the /player/timeline endpoint of Plex Media Server prior to 1.43.3.10861. It is the entry point of the Plex2Shell exploit chain.

Impact

An attacker can send a request with any made-up access token and make the Plex server send web requests to a location they choose, including back to itself. On its own, this has limited impact. It is the first step in the Plex2Shell exploit chain, which lets an unauthenticated attacker run code on the device hosting the server. This vulnerability is being actively exploited and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation:

Update Plex Media Server to 1.43.3.10861 or later. Updating does not remove an existing compromise, so servers that were reachable from the internet before updating should be checked for the signs of compromise listed in Plex's advisory.