Reading the KEV listing: CVE-2026-96655 and due dates that matter

CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities catalog on 20 October 2026, with a remediation deadline of 3 November 2026. This vulnerability is an authenticated server-side request forgery, CWE-918, affecting Plex Media Server 1.43.2 and earlier versions. It is reachable via the /video/:/transcode/universal path parameter. While common in home setups, this flaw poses higher risks in small business networks by exposing NAS backup targets and file shares. The official fix is version 1.43.3.10861.