How the four Plex CVEs relate: three request flaws and one path to code execution

CVE-2026-96652 is one of four identifiers CISA's CSAF guidance groups under Plex Media Server. Reading them together explains why a single upgrade fixes a set of problems that look unrelated at first: three of them abuse a request the server trusts, and the fourth turns an administrative preference into loaded code.

Vulnerability overview

The set contains four identifiers: CVE-2026-96652 (timeline SSRF, v3.1 4.3), CVE-2026-96654 ( searchOne URL injection, v3.1 6.5), CVE-2026-96655 (transcode arbitrary-host SSRF, v3.1 4.3) and CVE-2026-96656 ( TranscoderH264Options arbitrary file write, v3.1 7.2). All four list Plex Media Server versions below 1.43.3.10861 as affected and 1.43.3.10861 as unaffected.

Mechanism and exploitation conditions

The three request flaws share a pattern: a value that should name a scheme, a plugin or a local path is accepted from the network and used to build a request. Their prerequisites differ.…