CISA KEV: Plex Media Server — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Tuesday, October 20, 2026 at 12:00 AM UTC·Source: CISA KEV

Updated: Tuesday, October 20, 2026 at 08:00 PM UTC

Executive Summary

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Analysis

Indicators of Compromise (4)

CVE (4)

CVE-2026-96654

CVE-2026-96655

CVE-2026-96656

CVE-2026-96652

Source Attribution

Originally published by CISA KEV on Oct 20, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

53m agoThe Record

MEDIUMVulnerability

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

1h agoThe Hacker News

CRITICALVulnerability

I had plans for that second

The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.

1h agoCisco Talos