Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 20/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| media server | < 1.43.3.10861 | 1.43.3.10861 |
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free