Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: plex

CVE-2026-96652: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plex Media Server. This flaw enables an attacker with any valid X-Plex-Token to coerce the server into making POST requests to an attacker-controlled destination. The vulnerability is actively exploited, frequently as part of a chain with other Plex vulnerabilities (CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to facilitate the deployment of cryptominers and other malicious payloads.

Technical Analysis

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to SSRF. The vulnerability resides in the /player/timeline endpoint, where an attacker can supply a full URL within the protocol parameter. This forces the Plex server to initiate a POST request to the specified external destination.

  • Vulnerability Type: Server-Side Request Forgery (SSRF) – CWE-918.
  • Affected Versions: Plex Media Server before 1.43.3.10861.
  • Attack Vector: Network (AV:N).
  • Prerequisites: An attacker requires low privileges (PR:L), specifically any X-Plex-Token value, to exploit this vulnerability. No user interaction (UI:N) is required.
  • Impact: The direct impact is limited to information disclosure (C:L, I:N, A:N) according to CVSS 3.1 base score 4.3 (MEDIUM). However, in observed exploitation, this SSRF is chained with other vulnerabilities to achieve remote code execution and deploy cryptominers.

Detection

Defenders should monitor web server logs and process activity for indicators of exploitation or post-exploitation activity.

  • Web Server Logs: Look for POST requests to /player/timeline where the protocol parameter in the URI contains an external URL (e.g., http://, https://).
  • Network Traffic: Monitor Plex Media Server instances for outbound connections to unusual or suspicious IP addresses and domains, especially on non-standard ports, which could indicate C2 or cryptomining pool communication.
  • Process Creation: Detect unusual process spawns originating from the Plex Media Server process, particularly executables associated with cryptominers (e.g., xmrig.exe) or proxy tools.
  • Resource Utilization: Monitor CPU and memory usage on Plex Media Server hosts for spikes indicative of cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server SSRF Attempt via Player Timeline

title: Plex Media Server SSRF Attempt via Player Timeline
id: 902b11e2-a7d3-4e8c-84d3-066c1f10a76a
status: experimental
description: Detects attempts to exploit CVE-2026-96652 by monitoring web server logs for POST requests to /player/timeline with an external URL in the 'protocol' parameter.
logsource:
  product: webserver
detection:
  selection:
    cs-uri-stem: '/player/timeline'
    cs-method: 'POST'
    c-uri|contains: 'protocol='
    c-uri|contains|all:
      - '://'
      - 'protocol='
  condition: selection
level: high

Plex Media Server Spawning XMRig Cryptominer

title: Plex Media Server Spawning XMRig Cryptominer
id: 7f1e7a2b-c0d4-4f5a-8b3d-1e1c7d0a9b8c
status: experimental
description: Detects the Plex Media Server process spawning known cryptominer executables like XMRig, indicative of post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|contains: 'Plex Media Server.exe'
    Image|contains: 'xmrig'
  condition: selection
level: critical

Mitigations

Prioritize patching and implement network segmentation to limit potential impact.

  1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later to address CVE-2026-96652 and related vulnerabilities.
  2. Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment with strict egress filtering to prevent unauthorized outbound connections.
  3. Monitor Outbound Traffic: Implement network monitoring to detect and alert on suspicious outbound connections from Plex Media Server hosts.
  4. Endpoint Detection and Response (EDR): Ensure EDR solutions are deployed and configured to monitor for unusual process creation, file modifications, and resource utilization on servers hosting Plex Media Server.
  5. Review Access Controls: Regularly review and enforce least privilege principles for accounts and tokens used with Plex Media Server.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-96652
  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96652
  • https://zmain.info/blog/plex2shell
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db SHA256 hash of XMRig cryptominer (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 SHA256 hash of cryptominer docker file (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 SHA256 hash of UPX packed cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 SHA256 hash of UPX unpacked cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 SHA256 hash of ‘myawesomeproxy’ malware (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 176.65.139.228 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 217.60.194.116 Source IP for malicious file download (cryptominer) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP for initial exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 91.92.40.202 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain proxystream.st Domain associated with ‘myawesomeproxy’ malware traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.003 — Windows Command Shell
  • T1496 — Resource Hijacking
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,195 input / 1,702 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged actively_exploited_kev, cryptominer, medium, plex, remote code execution, ssrf, vulnerability, xmrigLeave a comment

CVE-2026-96655: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96655 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server. It allows an attacker to force the server to make requests to arbitrary internal or external addresses. This flaw is critical as it is actively being exploited, often chained with other vulnerabilities, to deploy cryptominer malware such as XMRig on compromised servers.

Technical Analysis

  • Vulnerability: Server-Side Request Forgery (SSRF) (CWE-918).
  • Affected Product: Plex Media Server.
  • Affected Versions: Before 1.43.3.10861.
  • Attack Vector: An authenticated user can manipulate the /video/:/transcode/universal path parameter to specify arbitrary URLs for the server to request.
  • Prerequisites: Requires an authenticated user session.
  • Impact: Allows an attacker to scan internal networks, access internal services, or potentially bypass firewall rules. When chained with other vulnerabilities, it can lead to remote code execution and resource hijacking.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, which community intelligence suggests are used together for remote code execution and cryptominer deployment.
  • CVSS 3.1: 4.3 (MEDIUM) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Detection

  • Monitor Plex Media Server web access logs for requests to the /video/:/transcode/universal path containing unusual or internal IP addresses/domains (e.g., 127.0.0.1, localhost, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) in the URI.
  • Look for outbound network connections originating from the Plex Media Server process to unexpected external IP addresses or ports, especially those associated with cryptomining pools (e.g., 3333, 4444, 5555, 7777, 8080, 9000, 14444).
  • Detect suspicious process creation by the Plex Media Server.exe process, such as cmd.exe, powershell.exe, sh.exe, or known cryptominer executables (e.g., xmrig.exe).
  • Hunt for resource utilization spikes (CPU, network) on the Plex server that are not correlated with legitimate media transcoding or streaming activities, potentially indicating cryptominer execution.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server SSRF Attempt via Transcode Path

title: Plex Media Server SSRF Attempt via Transcode Path
id: 9029a12a-f9c7-43f1-801e-2a21b36a18d9
status: experimental
description: Detects attempts to exploit CVE-2026-96655 by requesting internal or suspicious external addresses via the '/video/:/transcode/universal' path parameter in Plex Media Server web logs.
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|contains: '/video/:/transcode/universal'
  selection_target:
    c-uri|contains:
      - '127.0.0.1'
      - 'localhost'
      - '192.168.'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: all of selection*
level: high

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 7e7f1b2c-3d4e-4f5a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects Plex Media Server.exe spawning known cryptominer executables or common shell interpreters, indicating potential post-exploitation activity after chaining vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith: '\\Plex Media Server.exe'
  selection_child:
    Image|endswith:
      - '\\xmrig.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\sh.exe'
  condition: all of selection*
level: critical

Mitigations

  1. Immediately update Plex Media Server to version 1.43.3.10861 or later to patch CVE-2026-96655 and related vulnerabilities.
  2. Implement network segmentation to restrict outbound connections from the Plex Media Server to only necessary services and destinations.
  3. Enforce strong authentication policies for all Plex users, including multi-factor authentication where possible.
  4. Regularly review Plex Media Server logs for suspicious activity and unexpected outbound connections.
  5. Consider placing Plex Media Server behind a reverse proxy or Web Application Firewall (WAF) to filter malicious requests.

References

  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96655
  • https://zmain.info/blog/plex2shell
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db XMRig cryptominer payload (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 Cryptominer payload (docker) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 Cryptominer payload ‘x’ (UPX packed) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 Cryptominer payload ‘x’ (UPX unpacked) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 Proxy payload ‘myawesomeproxy’ (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 176.65.139.228 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 217.60.194.116 Source IP for malicious file download (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 91.92.40.202 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain proxystream.st Domain related to proxy service traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
URL https://zmain.info/blog/plex2shell Vulnerability research blog detailing the chained exploit (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
malware_family XMRig Cryptominer malware deployed post-exploitation
malware_family myawesomeproxy Proxy malware deployed post-exploitation

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1090.003 — Multi-hop Proxy
  • T1496 — Resource Hijacking
  • T1059 — Command and Scripting Interpreter
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,111 input / 2,003 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cryptominer, exploitation, medium, plex, ssrf, vulnerability, windows, xmrigLeave a comment

CVE-2026-96654: Plex Media Server URI Scheme Neutralization Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

Plex Media Server is affected by CVE-2026-96654, a medium-severity vulnerability allowing attackers to manipulate URI schemes to call internal plugin functions. This flaw can be chained with other vulnerabilities to achieve remote code execution. Threat actors are actively exploiting this to deploy cryptomining malware, making immediate patching critical for affected organizations and users.

Technical Analysis

  • CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page.
  • Description: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne, allowing an attacker to call other plugins’ functions and supply their own parameters.
  • CVSS 3.1: 6.5 (Medium) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates network access, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.
  • Weakness: CWE-84 (Improper Neutralization of Input During Web Page Generation).
  • Affected Versions: Plex Media Server versions prior to 1.43.0.10861.
  • Attack Vector: Network-based, unauthenticated. Exploitation involves crafting malicious URI requests to the Plex Media Server.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, potentially escalating impact to remote code execution.
  • Observed Impact: Active exploitation has been observed, leading to the deployment of cryptominer malware (e.g., XMRig) and proxy software (myawesomeproxy).

Detection

  • Monitor Plex Media Server process (Plex Media Server.exe) for unusual child process creation (e.g., cmd.exe, powershell.exe, wscript.exe, cscript.exe, or known cryptominer executables like xmrig.exe or myawesomeproxy.exe).
  • Inspect web server access logs for Plex Media Server for requests containing searchOne with unusual or encoded parameters, especially those attempting to invoke internal plugin functions.
  • Look for outbound network connections from the Plex Media Server process to known cryptomining pools or unusual IP addresses/ports.
  • Scan for the presence of known cryptominer executables (xmrig.exe) or proxy software (myawesomeproxy.exe) in unexpected directories, particularly within the Plex installation path or temporary directories.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server Spawning Suspicious Child Process

title: Plex Media Server Spawning Suspicious Child Process
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes (e.g., cmd, powershell, cryptominers) spawned by Plex Media Server, indicating potential exploitation of CVE-2026-96654 or similar vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\Plex Media Server.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\xmrig.exe'
      - '\myawesomeproxy.exe'
  condition: selection
level: high

XMRig Cryptominer Process Creation

title: XMRig Cryptominer Process Creation
id: 1f2e3d4c-5b6a-7f8e-9d0c-1b2a3f4e5d6c
status: experimental
description: Detects the creation of the XMRig cryptominer process, often deployed after successful exploitation of vulnerabilities like CVE-2026-96654.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\xmrig.exe'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes.
  2. Network Segmentation: Isolate Plex Media Server instances from critical internal networks.
  3. Restrict Outbound Connectivity: Implement firewall rules to limit outbound connections from the Plex Media Server to only necessary services, blocking access to known cryptomining pools.
  4. Principle of Least Privilege: Ensure the Plex Media Server runs with the minimum necessary user permissions.
  5. Regular Audits: Periodically review Plex Media Server logs and system activity for signs of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-96654
  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96654
  • https://zmain.info/blog/plex2shell
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db SHA256 hash of XMRig cryptominer (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 SHA256 hash of cryptominer docker file (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 SHA256 hash of UPX packed cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 SHA256 hash of UPX unpacked cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 SHA256 hash of ‘myawesomeproxy’ malware (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 176.65.139.228 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 217.60.194.116 Source IP for malicious file download (cryptominer) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP for initial exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 91.92.40.202 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain proxystream.st Domain associated with ‘myawesomeproxy’ malware traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain sslip.io DNS service leveraged by attacker for owner token theft (via https://zmain.info/blog/plex2shell)
Email security@plex.tv Plex security contact email for vulnerability reporting (via https://zmain.info/blog/plex2shell)

MITRE ATT&CK

  • T1059.003 — Windows Command Shell
  • T1059.001 — PowerShell
  • T1496 — Resource Hijacking
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1190 — Exploit Public-Facing Application
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,105 input / 1,684 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cryptominer, exploitation, medium, plex, remote code execution, vulnerability, windowsLeave a comment

CVE-2026-96656: Plex Media Server Arbitrary File Write Vulnerability Exploited In-The-Wild

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96656 is a high-severity arbitrary file write vulnerability in Plex Media Server, affecting versions prior to 1.43.3.10861. An authenticated admin user can exploit this to write arbitrary files, which are then executed upon server load. This vulnerability is being actively exploited in conjunction with other Plex vulnerabilities to deploy cryptominers such as XMRig, posing a significant resource hijacking and potential further compromise risk.

Technical Analysis

  • Vulnerability ID: CVE-2026-96656
  • Weakness Enumeration: CWE-73 (External Control of File Name or Path).
  • Affected Products: Plex Media Server before 1.43.3.10861.
  • Attack Vector: An authenticated admin user can manipulate the TranscoderH264Options preference.
  • Exploitation Mechanism: The TranscoderH264Options preference is appended verbatim to x264’s option string during transcoding. This allows an attacker to inject arbitrary data into a file path or name, leading to the creation of arbitrary files.
  • Code Execution: At startup, Plex Media Server loads and executes all .so (shared object) files without signature, execute bit, or symbol checks. By writing a malicious .so file to a directory Plex loads from, an attacker can achieve arbitrary code execution.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655 to achieve broader impact, such as privilege escalation or bypassing other controls.
  • CVSS 3.1 Score: 7.2 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Plex Media Server log files for unusual TranscoderH264Options modifications or errors related to transcoding that indicate path manipulation attempts.
  • Look for the creation of new or modified .so files in Plex Media Server installation directories, data directories (e.g., C:\ProgramData\Plex Media Server\ on Windows, /var/lib/plexmediaserver/ on Linux), or temporary directories (e.g., C:\Windows\Temp\, /tmp/).
  • Monitor for unexpected child processes spawned by the Plex Media Server executable (e.g., Plex Media Server.exe, Plex Transcoder.exe) or its associated processes. Look for cmd.exe, powershell.exe, sh, bash, python, or known cryptominer executables (e.g., xmrig).
  • Implement network monitoring to detect outbound connections from the Plex Media Server to known cryptomining pools, suspicious IP addresses, or C2 infrastructure.
  • Utilize File Integrity Monitoring (FIM) on critical Plex Media Server directories to detect unauthorized file changes or creations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 9381e4b3-c15b-4b1a-8e2a-1f2d3c4e5f6a
status: experimental
description: Detects suspicious process creation by Plex Media Server, indicative of post-exploitation activity after arbitrary file write.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection
level: high

Plex Media Server Suspicious Shared Object File Creation

title: Plex Media Server Suspicious Shared Object File Creation
id: 7a2b0c1d-e3f4-5g6h-7i8j-9k0l1m2n3o4p
status: experimental
description: Detects the creation of new .so files in potentially exploitable locations by Plex Media Server, which could indicate arbitrary file write exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '.so'
    Image|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    TargetFilename|contains:
      - 'C:\ProgramData\Plex Media Server\'
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
  condition: selection
level: high

XMRig Cryptominer Process Activity

title: XMRig Cryptominer Process Activity
id: 5d6e7f8a-9b0c-1d2e-3f4a-5b6c7d8e9f0a
status: experimental
description: Detects common process creation patterns associated with XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-96656.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_img:
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmd:
    CommandLine|contains:
      - '--donate-level'
      - '--url'
      - '--user'
      - '--pass'
      - '-o stratum+tcp://'
      - '-a rx/0'
      - '-k --nicehash'
  condition: 1 of selection_*
level: high

Mitigations

  1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes for the latest security updates.
  2. Restrict Admin Access: Limit administrative access to Plex Media Server to only trusted and authorized personnel.
  3. Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment to limit lateral movement and impact in case of compromise.
  4. Monitor Outbound Connections: Implement egress filtering on network firewalls to prevent unauthorized outbound connections from the Plex Media Server, particularly to known cryptomining ports or suspicious IP ranges.
  5. Regular Backups: Maintain regular backups of Plex Media Server configurations and data to facilitate recovery from potential compromise.

References

  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96656
  • https://zmain.info/blog/plex2shell
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db XMRig cryptominer payload (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 50e93e8d8c26bd95d0ba91ba9b7c5c15532050866f52c3aef04f9773b7418767 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 Cryptominer payload (docker) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 Cryptominer payload ‘x’ (UPX packed) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 6915f57c96c880803863d30eefaa5e3fe3923e11c948cb6747c68478d2e6cf40 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 a580786ff7336e916e92bb79db96d5d6f48119cd3b0b4e45211b47e298be5380 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 a9a309154493193c70bf6f805fe70e1bc4e9564e2f0e20cd1600c72587c7e65f XMRIG · confidence 95% · first seen 2026-10-18
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 Cryptominer payload ‘x’ (UPX unpacked) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 cababb6448ee3f2a274f516dc6b0fdc9f47d084a84d7bd164546c9c4b1755d44 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 Proxy payload ‘myawesomeproxy’ (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 f083b3647e50fb548c2b97887e51927bc62b429aaa7c4828e316bd5ef6503453 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 f599491cce46b1d94c762eff392458ae015e7163620b07ad7ceaa16708b1bf4f Unknown malware · confidence 100% · first seen 2026-10-20
IP Address 176.65.139.228 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 202.78.167.55 Unknown malware · confidence 100% · first seen 2026-10-20
IP Address 217.60.194.116 Source IP for malicious file download (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 77.90.185.205 XMRIG · confidence 95% · first seen 2026-10-18
IP Address 91.92.40.202 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain autoccb.tech Unknown malware · confidence 100% · first seen 2026-10-20
Domain ota.proxystream.st XMRIG · confidence 95% · first seen 2026-10-18
Domain proxystream.st Domain related to proxy service traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain www.autoccb.tech Unknown malware · confidence 100% · first seen 2026-10-20
URL http://217.60.194.116/docker XMRIG · confidence 95% · first seen 2026-10-18
URL https://www.autoccb.tech/api/v1/poll Unknown malware · confidence 100% · first seen 2026-10-20
URL https://www.autoccb.tech/api/v1/result Unknown malware · confidence 100% · first seen 2026-10-20
URL https://zmain.info/blog/plex2shell Vulnerability research blog detailing the chained exploit (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)

MITRE ATT&CK

  • T1059.001 — PowerShell
  • T1059.003 — Windows Command Shell
  • T1574.002 — DLL Side-Loading
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1190 — Exploit Public-Facing Application
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,236 input / 2,147 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged arbitrary file write, cryptominer, cwe-73, high, high-severity, media server, plex, remote code execution, vulnerability, xmrigLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.