CVE-2026-96655 is a Server-Side Request Forgery (SSRF) vulnerability in the /video/:/transcode/universal path parameter of Plex Media Server prior to 1.43.3.10861 that allows an authenticated user to request arbitrary internal or external addresses.

Impact

An authenticated user can make the Plex server send requests to internal or external addresses of their choosing. Plex describes its role in the Plex2Shell exploit chain as exposing the server owner's admin token, which the attacker then uses to change server settings. This vulnerability is being actively exploited and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation:

Update Plex Media Server to 1.43.3.10861 or later. Updating does not remove an existing compromise, so servers that were reachable from the internet before updating should be checked for the signs of compromise listed in Plex's advisory.