Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell) CVE-2026-96652
- Severity
- EPSS Score
- EPSS Percentile
- Vulnerability description
- Not available
- Risk description
- Not available
- Recommendation
- Not available
- References
- https://zmain.info/blog/plex2shellhttps://github.com/gmh5225/plex2shellhttps://www.cve.org/CVERecord?id=CVE-2026-96652https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonhttps://github.com/advisories/GHSA-5p7w-r379-3c2m
- Codename
- Not available
- Detectable with
- Network Scanner
- Scan engine
- Nuclei
- Cisa Kev
Yes- Exploitable with Sniper
- No
- CVE Published
- Sep 23, 2026
- Detection added at
- Software Type
- Not available
- Vendor
- plex
- Product
- plex_media_server
Detect this vulnerability now!
Check your clients' targets (or your own) for this vulnerability and thousands more! Get proof for validation with our ethical hacking toolkit.