Plex Media Server SSRF Vulnerability Added to CISA KEV List

## Overview CISA has added CVE-2026-96655 to its Known Exploited Vulnerabilities (KEV) list. This vulnerability affects Plex Media Server versions prior to 1.43.3.10861. It allows authenticated users to exploit server-side request forgery (SSRF) through the '/video/:/transcode/universal' path parameter. ## Technical Details The SSRF vulnerability enables an authenticated user to send requests to arbitrary internal or external addresses. This could lead to unauthorized access to sensitive resources within the network. The flaw can be exploited in conjunction with other vulnerabilities, specifically CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, enhancing the potential impact of an attack. ## Impact Successful exploitation of CVE-2026-96655 can compromise the integrity and confidentiality of internal systems. Attackers may leverage this vulnerability to access sensitive data or services that should not be publicly reachable. The CVSS score of 5.3 indicates a moderate risk level, but the potential for chaining with other vulnerabilities raises the overall threat. ## Mitigation Defenders should immediately update Plex Media Server to version 1.43.3.10861 or later. Regularly monitor for updates and apply patches promptly. Additionally, restrict access to the server and limit authenticated user permissions to minimize exposure to this and other vulnerabilities.