Plex Media Server security flaw

Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)

Published 21-Oct-2026 09:51 UTC · First seen 21-Oct-2026 09:51 UTC

Sources

• CISA Known Exploited Vulnerabilities Catalog · 20-Oct-2026
• The Hacker News · 21-Oct-2026