MEDIUMCVSS 4.3Actively exploited · CISA KEV since 2026-10-20Vulnerability
CVE-2026-96652
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Properties
- Euvd product
- Media Server
- Vulnerability name
- Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- First seen
- 2026-10-20T19:58:24+00:00
- Epss score
- 0.00222
- Cvss score
- 4.3
- Last seen
- 2026-10-20T19:58:24+00:00
- Due date
- 2026-11-03
- Euvd assigner
- cisa-cg
- Retrieved at
- 2026-10-21T01:24:51+00:00
- Exploited euvd since
- 2026-10-20T00:00:00+00:00
- Src batch id
- euvd-20261021T003401Z-4c0cc1
- Date added
- 2026-10-20
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85367
- Score
- 4.3
- Euvd base score version
- 4.0
- Fetched at
- 2026-10-21T00:34:02+00:00
- Euvd vendor
- Plex
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-10-18T14:03:09+00:00
- Euvd base score
- 5.3
Related Entities (3)
AFFECTS_PRODUCT (1)
HAS_WEAKNESS (1)
MENTIONED_IN (1)
Explore deeper with Ninja Signal's threat intelligence graph