Critical Analysis: CVE-2026-96655 - Plex Media Server Server-Side Request Forgery (SSRF) Vulnera... — October 21, 2026

Published 21 Oct 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

Initial Discovery and Context On October 21, 2026, details emerged regarding CVE-2026-96655, a high-severity Server-Side Request Forgery (SSRF) flaw impacting Plex Media Server (PMS). The vulnerability resides in the core network request dispatcher used by the media server's internal transcoder and metadata aggregation engines. While Plex is ubiquitously recognized as a consumer media streaming platform, its footprint across enterprise staging environments, digital asset management pipelines, media conglomerates, and hybrid cloud lab infrastructures is surprisingly dense. We routinely encounter PMS instances dual-homed across perimeter DMZs and internal storage arrays during our threat hunting and red team engagements. The flaw affects Plex Media Server versions 1.41.2 through 1.42.3 across Linux, Windows, macOS, and containerized Docker/Kubernetes distributions. Discovered during an int