CVE-2026-96652

Medium4.3 Published on Sep 23, 2026

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Early warning: exploitation observed

Exploitation observed since Oct 18, 2026
Not yet in the official CISA catalogue
First attack observed 24 days after disclosure

Source: VulnCheck KEV · Oct 18, 2026

CVSS score4.3 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness type (CWE)CWE-918

Vendorsplex

Affected products

Vendors	Product	Versions
plex	media server	< 1.43.0.10861

Vulnerabilities

Public Plex2Shell Exploit Used to Compromise Exposed Plex Media Servers

Researchers observed public Plex2Shell exploit used against a Plex honeypot to deploy XMRig miner and proxy software, per single-server data.

Oct 19, 202617:30 3 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database