CVE-2026-96655: what the Plex Media Server SSRF actually exposes Plex Media Server sits on the boundary between a home network and the internet. CVE-2026-96655 is a server-side request forgery flaw in that boundary, and CISA added it to the Known Exploited Vulnerabilities catalog on 20 October 2026. The official Plex advisory covers Media Server 1.43.2 and earlier, and the fix ships in 1.43.3.10861. Anyone running a self-hosted server should treat the upgrade as routine maintenance rather th...