First published Oct 20, 2026, 8:32:15 PM UTC · Last updated Oct 20, 2026, 8:32:15 PM UTC

CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Reported by CISA Known Exploited Vulnerabilities

A server-side request forgery flaw in Plex Media Server could let an attacker make the server send a POST request to a chosen destination, and may be chained with three other CVEs. The notice directs stakeholders to apply vendor mitigations or discontinue use if mitigations are unavailable.

Illustrative image: © Belgian Presidency of the Council of the European Union / Julien Nizet — belgium24.eu/Wikimedia Commons, CC BY 2.0

Share this event

Follow: Events in United States

Manage follows

Why it matters

The notice calls for mitigation or discontinuing use when mitigation is unavailable.

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 2/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 3/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 3/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Report an issue

Read our editorial process and corrections policy.

Continue exploring

Related developments reported in the last 30 days. These are not necessarily ongoing incidents.

Same topic
Meta races the clock to prove to Brazil’s electoral court it treats Lula and Bolsonaro equallyOct 20, 2026, 10:09 AM UTC
Brazil’s electoral court gave Meta 24 hours to demonstrate that its algorithms and AI treat President Luiz Inácio Lula da Silva and Senator Flávio Bolsonaro equally. The deadline expires Tuesday, five days before the runoff; failure to comply would double the daily fine to one million reais.
Same topic
CMA outlines proposals to unlock contactless technology on Apple iPhoneOct 20, 2026, 10:00 AM UTC
The source says opening iPhone contactless technology could encourage innovation, reduce costs and support UK fintech growth. It provides no further details about the proposals.
Same topic
IEC enters into partnership to counter disinformationOct 20, 2026, 8:05 AM UTC
South Africa’s Electoral Commission partnered with Google, Meta, Microsoft, TikTok and Moxii Africa ahead of the 4 November 2026 Local Government Elections. The source describes this as an effort to support accurate election information and counter disinformation.
Same topic
Stablecoins, Solana and Ethereum: Which Blockchains Are Winning in South America?Oct 20, 2026, 12:18 AM UTC
The source says Brazilian tax data recorded stablecoins at 80.2% of declared cryptocurrency volume in 2025, with USDT at 72%. It provides no further details about Solana or Ethereum.
Same topic
CVE-2026-96656: Plex Media Server External Control of File Name or Path VulnerabilityOct 20, 2026, 12:00 AM UTC
The source reports a Plex Media Server vulnerability that may allow an admin user to write arbitrary files that can be executed on load, and says it can be chained with three other CVEs. It calls for applying vendor mitigations or discontinuing use if mitigations are unavailable.
Same topic
CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityOct 20, 2026, 12:00 AM UTC
The vulnerability may let an attacker invoke other plugins’ functions with supplied parameters and can be chained with three other CVEs. The source recommends applying vendor mitigations in line with CISA guidance or discontinuing use if mitigations are unavailable.

Loading related developments…

Explore events in united states