22 October 2026
Reference: CVE-2026-96655
1. What is being reported?
The Plex Media Server has a vulnerability that lets an authenticated user request the server to reach out to any internal or external internet address through a specific part of the software. This could be used by attackers to access or interact with parts of your network or other systems that should be protected.
2. What this means in plain English
If your organisation uses Plex Media Server, someone who can log in might be able to trick the server into contacting unsafe or unauthorised locations. This could lead to data exposure or other security issues. Even though the user must be authenticated, it still poses a risk if login details are compromised or if users have more access than necessary.
3. Could this affect a small business?
Small organisations using Plex Media Server could be affected, especially if the server is accessible over the internet or if multiple people have login access. If you do not use Plex Media Server, or it is not connected to your network, this vulnerability does not apply.
4. What to do now
- Check if you are running Plex Media Server and identify the version installed.
- Apply any updates or patches provided by Plex to fix this vulnerability as soon as possible.
- Review who has login access to the Plex Media Server and limit it to trusted users only.
- Ask your IT provider to assess whether your Plex Media Server is exposed to the internet and follow recommended security practices.
5. Ask your IT provider
Can you confirm if our Plex Media Server is updated to a version that fixes CVE-2026-96655, and what steps have been taken to secure it against this known exploited vulnerability?
6. Bottom line
If you use Plex Media Server, update it promptly and limit access to reduce the risk of attackers exploiting this vulnerability.
Information based on CISA KEV, NVD and reputable security reporting.