## Overview
CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities (KEV) list on October 20, 2026. This vulnerability affects Plex Media Server versions prior to 1.43.3.10861. The addition to the KEV list indicates a federal deadline for remediation due to active exploitation evidence.
## Technical Details
The vulnerability is a server-side request forgery (SSRF) flaw. It allows an attacker to manipulate the 'protocol' parameter in a request to the '/player/timeline' endpoint. By using any valid X-Plex-Token value, the attacker can include a full URL. This enables the Plex server to send POST requests to an external destination controlled by the attacker. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 for more severe attacks.
## Impact
Successful exploitation of this vulnerability may allow attackers to access internal resources or perform actions on behalf of the Plex server. This could lead to data exfiltration or further compromise of the network. The CVSS score of 5.3 indicates a moderate severity level, but the potential impact can be significant depending on the attacker's goals and the server's environment.
## Mitigation
Defenders should upgrade to Plex Media Server version 1.43.3.10861 or later as soon as possible. Regularly monitor for updates and apply patches promptly. Additionally, review access controls for X-Plex-Token usage to limit exposure. Implement network segmentation to reduce the risk of SSRF attacks impacting other services.
CSURFACE Threat Sensor