CVE-2026-96655

Description

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Overview

State: PUBLISHED
Assigner (CNA): cisa-cg
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-918
Reserved: 2026-09-23
Published: 2026-09-23 16:06 UTC
Last updated: 2026-09-23 16:46 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96655.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 17:17:23 UTC
NVD last modified: 2026-09-23 17:58:26 UTC
NVD CVSS v3.1: 4.3 / 10 MEDIUM source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85369
Assigner: cisa-cg
Published: Sep 23, 2026, 4:06:53 PM
Updated: Sep 23, 2026, 4:46:13 PM
EUVD base score (CVSS 4.0): 5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: Plex
Products: Media Server (0 <1.43.3.10861)
Aliases: GHSA-9x88-w2p7-56vh

ENISA description: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
Plex	Media Server	`0` (affected), `1.43.3.10861` (unaffected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

url third-party-advisory
url release-notes
url vdb-entry
url third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://forums.plex.tv/t/plex-media-server/30447/711 9119a7d8-5eab-497f-8521-727c672e3725
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json 9119a7d8-5eab-497f-8521-727c672e3725
https://www.cve.org/CVERecord?id=CVE-2026-96655 9119a7d8-5eab-497f-8521-727c672e3725
https://zmain.info/blog/plex2shell 9119a7d8-5eab-497f-8521-727c672e3725

Remediations (10)

September 2026 Patch Breaks RDS: Fix Without Rolling Back

web:byteiota.com

That's not all. September's Patch Tuesday also fixed two zero-days under active exploitation: CVE - 2026 -85880, a heap buffer overflow in Windows ALPC that allows local privilege escalation to SYSTEM, and CVE - 2026 -81963, a link-following flaw in the Windows Update Stack. Rolling back removes those fixes too.

2026-09-24 11:43 UTC
Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-09-24 11:43 UTC
CVE-2026-96655: Plex Media Server Vulnerability - CVETodo

web:cvetodo.com

CVE-2026-96655 is a CVSS 4.3 medium-severity vulnerability in Media Server. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-24 11:43 UTC
Nvd-cve-2026-45655

web:nvd.nist.gov

Quick Info CVE Dictionary Entry: CVE - 2026 -45655 NVD Published Date: Jun 09, 2026 NVD Last Modified: Jul 23, 2026 Source: Microsoft Corporation

2026-09-24 11:43 UTC
Johnson Controls C·CURE 9000 RCE Vulnerability: ICSA-26-204-01 Advisory ...

web:otsecuritywire.com

Johnson Controls C·CURE 9000 RCE Vulnerability: ICSA-26-204-01 Advisory and Mitigation CISA published ICSA-26-204-01 on August 11, 2026 , disclosing CVE - 2026 -21655, a remotely exploitable code execution vulnerability in Johnson Controls C·CURE 9000 physical access control systems.

2026-09-24 11:43 UTC
CVE-2026-95655 — HIGH severity vulnerability | Release Alert

web:releasealert.dev

CVE - 2026 -95655 is a high-severity vulnerability (CVSS 8.1) affecting 1 tracked project. Published September 22, 2026 . See affected versions, references, and get alerted when a fix ships.

2026-09-24 11:43 UTC
Microsoft September 2026 Patch Tuesday: 966 Flaws and 2 Zero-Days ...

web:securityarsenal.com

Microsoft's record-breaking September 2026 Patch Tuesday patches 966 vulnerabilities, including two actively exploited zero-days. Prioritize patching now — here's how to triage, detect, and remediate.

2026-09-24 11:43 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-24 11:43 UTC
About the security content of iOS 26.5 and iPadOS 26.5

web:support.apple.com

This document describes the security content of iOS 26.5 and iPadOS 26.5.

2026-09-24 11:43 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-24 11:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-96655.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:34:51.715177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:46:13.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Media Server",
          "vendor": "Plex",
          "versions": [
            {
              "lessThan": "1.43.3.10861",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.43.3.10861"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Zach Main"
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-96655",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-09-14T18:23:48.400949Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:06:53.133Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "name": "url",
          "tags": [
            "release-notes"
          ],
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "name": "url",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96655"
        },
        {
          "name": "url",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "title": "Plex Media Server arbitrary-host SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-96655",
    "datePublished": "2026-09-23T16:06:53.133Z",
    "dateReserved": "2026-09-23T14:42:25.245Z",
    "dateUpdated": "2026-09-23T16:46:13.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}