CISA adds Plex Media Server SSRF to exploited vulnerabilities catalog

CISA listed CVE-2026-96655 in its Known Exploited Vulnerabilities catalog: an SSRF (CWE-918) in Plex Media Server 1.43.2 and earlier via the path parameter in /video/:/transcode/universal. The fix is version 1.43.3.10861, with a US federal remediation deadline of November 3, 2026.

• The flaw affects Plex Media Server 1.43.2 and earlier
• The fix ships in Plex Media Server 1.43.3.10861
• The BOD 26-04 remediation deadline is November 3, 2026
• The entry notes chaining with CVE-2026-96652, -96654 and -96656