What is CVE-2026-96652?

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-20. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-96652 — NVD, CVE-2026-96652 — CVE Program record

First, confirm where the vulnerable product is running

CVE-2026-96652 is an SSRF in Plex Media Server before version 1.43.3.10861 that allows an attacker with any valid X-Plex-Token to force the server to POST to an arbitrary destination via the '/player/timeline' endpoint's 'protocol' parameter. The vulnerability is chainable with three other CVEs, increasing risk. No fixed version is established in the supplied catalog entry; the vendor advisory (Plex forums post) must be consulted for the authoritative remediation. Since Plex Media Server is customer-managed software, cloud providers' patch management tools only apply if the server runs on a supported OS with a vendor-packaged update; they do not patch the Plex application directly. Applicability to managed cloud services is not established by the sources.

The named vulnerable product is Plex Media Server. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-96652 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify EC2 instances or on-premises servers running Plex Media Server via Systems Manager inventory or resource tags.
  2. Confirm the Plex installation method (native package, Docker, manual) to determine if OS-level patching via Patch Manager can deliver a vendor-supplied update.
  3. If Plex runs in a container on ECS/EKS/Fargate, verify the vendor provides a fixed container image and plan a replacement deployment.
  4. Review security groups and network ACLs to ensure Plex management interfaces are not exposed to untrusted networks.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Use Azure Update Manager or Azure Resource Graph to locate VMs (Azure or Arc-connected) hosting Plex Media Server.
  2. Determine whether the Plex installation consumes OS vendor packages that Update Manager can patch, or if it requires a vendor-specific upgrade outside OS channels.
  3. For containerized deployments on AKS or Container Apps, confirm a fixed vendor image exists and schedule a rolling update.
  4. Check network security groups and Azure Firewall rules to restrict access to Plex's administrative ports.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Inventory Compute Engine VMs running Plex Media Server using VM Manager or Cloud Asset Inventory.
  2. Assess if the Plex package is maintained through the OS repository (patchable via VM Manager Patch) or requires a direct vendor upgrade.
  3. For GKE or Cloud Run deployments, validate the availability of a patched container image from Plex and orchestrate a redeployment.
  4. Verify VPC firewall rules and IAP/IAM policies limit exposure of the Plex web UI and API endpoints.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. After applying the vendor fix, query the Plex Media Server version via its web UI (Settings > General > Server) or API endpoint '/identity' to confirm it reports 1.43.3.10861 or later.
  2. Review Plex server logs for anomalous POST requests to '/player/timeline' with external URLs in the 'protocol' parameter around the time of exploitation.
  3. Run a safe SSRF test from a controlled host: send an authenticated request to '/player/timeline' with a 'protocol' parameter pointing to a local listener and verify the server no longer initiates the outbound connection.
  4. Validate that X-Plex-Token rotation has been performed for any tokens potentially exposed before patching.

Questions teams ask

What is the exact fixed version for Plex Media Server?

The supplied CISA catalog entry does not establish a fixed version; it references the vendor advisory. The official CVE record states 'before 1.43.3.10861', but you must confirm the exact patched release and upgrade instructions on the Plex forums post linked in the references.

Can AWS Systems Manager Patch Manager, Azure Update Manager, or GCP VM Manager Patch automatically fix this vulnerability?

Only if Plex Media Server is installed via a supported OS package repository that publishes the vendor fix. These tools manage OS-level packages, not arbitrary vendor applications, Docker images, or manual installations. Check your installation method first.

Is my managed Plex cloud service (e.g., a SaaS offering) affected?

Applicability to any managed cloud service is not established by the supplied sources. Do not assume affected or unaffected status; contact the service provider directly for their remediation statement.

Should I rotate my X-Plex-Token after patching?

Yes. The vulnerability can be exploited with 'any X-Plex-Token value.' If tokens may have been logged, shared, or intercepted before patching, rotate them in the Plex web UI (Settings > Users > Sharing) to invalidate potentially compromised credentials.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.