Medium severity4.3CISA KEVNVD Advisory· Published Sep 23, 2026· Updated Oct 21, 2026
CVE-2026-96652
CVE-2026-96652
Description
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.43.3.10861
Patches
Vulnerability mechanics
References
5- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party AdvisoryVDB Entry
- zmain.info/blog/plex2shellnvdThird Party Advisory
- forums.plex.tv/t/plex-media-server/30447/711nvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
7- ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and MoreThe Hacker News · Oct 26, 2026
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard FlawsThe Hacker News · Oct 21, 2026
- Plexcor: 4 Actively-Exploited Flaws Added to CISA KEVVypr Intelligence · Oct 20, 2026
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy BackdoorThe Hacker News · Oct 19, 2026
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After DisclosureSecurityWeek · Oct 19, 2026
- Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer MalwareCyber Security News · Oct 19, 2026
- CISA Adds Six Known Exploited Vulnerabilities to CatalogCISA Alerts