media server vulnerabilities and fixes

Recent CVEs affecting media server, with upgrade or downgrade steps. 4 tracked.

media server has 4 tracked vulnerabilities, 0 critical and 4 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 4. Most recent: 2026-09-23. Highest priority: CVE-2026-96656 (score 64/100).

• CVE-2026-96652 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-96655 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability

FAQ

How do I fix media server vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is media server being exploited right now?

Yes: 4 media server CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which media server CVE should I patch first?

CVE-2026-96656 currently ranks highest (64/100): Plex Media Server External Control of File Name or Path Vulnerability.

← Back to latest CVEs