CVE-2026-96652: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Overview

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plex Media Server. This flaw enables an attacker with any valid X-Plex-Token to coerce the server into making POST requests to an attacker-controlled destination. The vulnerability is actively exploited, frequently as part of a chain with other Plex vulnerabilities (CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to facilitate the deployment of cryptominers and other malicious payloads.

Technical Analysis

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to SSRF. The vulnerability resides in the /player/timeline endpoint, where an attacker can supply a full URL within the protocol parameter. This forces the Plex server to initiate a POST request to the specified external destination.

• Vulnerability Type: Server-Side Request Forgery (SSRF) – CWE-918.
• Affected Versions: Plex Media Server before 1.43.3.10861.
• Attack Vector: Network (AV:N).
• Prerequisites: An attacker requires low privileges (PR:L), specifically any X-Plex-Token value, to exploit this vulnerability. No user interaction (UI:N) is required.
• Impact: The direct impact is limited to information disclosure (C:L, I:N, A:N) according to CVSS 3.1 base score 4.3 (MEDIUM). However, in observed exploitation, this SSRF is chained with other vulnerabilities to achieve remote code execution and deploy cryptominers.

Detection

Defenders should monitor web server logs and process activity for indicators of exploitation or post-exploitation activity.

• Web Server Logs: Look for POST requests to /player/timeline where the protocol parameter in the URI contains an external URL (e.g., http://, https://).
• Network Traffic: Monitor Plex Media Server instances for outbound connections to unusual or suspicious IP addresses and domains, especially on non-standard ports, which could indicate C2 or cryptomining pool communication.
• Process Creation: Detect unusual process spawns originating from the Plex Media Server process, particularly executables associated with cryptominers (e.g., xmrig.exe) or proxy tools.
• Resource Utilization: Monitor CPU and memory usage on Plex Media Server hosts for spikes indicative of cryptomining activity.

Sigma Detection Rules

Plex Media Server SSRF Attempt via Player Timeline

title: Plex Media Server SSRF Attempt via Player Timeline
id: 902b11e2-a7d3-4e8c-84d3-066c1f10a76a
status: experimental
description: Detects attempts to exploit CVE-2026-96652 by monitoring web server logs for POST requests to /player/timeline with an external URL in the 'protocol' parameter.
logsource:
  product: webserver
detection:
  selection:
    cs-uri-stem: '/player/timeline'
    cs-method: 'POST'
    c-uri|contains: 'protocol='
    c-uri|contains|all:
      - '://'
      - 'protocol='
  condition: selection
level: high

Plex Media Server Spawning XMRig Cryptominer

title: Plex Media Server Spawning XMRig Cryptominer
id: 7f1e7a2b-c0d4-4f5a-8b3d-1e1c7d0a9b8c
status: experimental
description: Detects the Plex Media Server process spawning known cryptominer executables like XMRig, indicative of post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|contains: 'Plex Media Server.exe'
    Image|contains: 'xmrig'
  condition: selection
level: critical

Mitigations

Prioritize patching and implement network segmentation to limit potential impact.

1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later to address CVE-2026-96652 and related vulnerabilities.
2. Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment with strict egress filtering to prevent unauthorized outbound connections.
3. Monitor Outbound Traffic: Implement network monitoring to detect and alert on suspicious outbound connections from Plex Media Server hosts.
4. Endpoint Detection and Response (EDR): Ensure EDR solutions are deployed and configured to monitor for unusual process creation, file modifications, and resource utilization on servers hosting Plex Media Server.
5. Review Access Controls: Regularly review and enforce least privilege principles for accounts and tokens used with Plex Media Server.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-96652
• https://forums.plex.tv/t/plex-media-server/30447/711
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-96652
• https://zmain.info/blog/plex2shell
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652
• https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
• https://ltna.com.au/cyber

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059.003 — Windows Command Shell
• T1496 — Resource Hijacking
• T1583 — Acquire Infrastructure
• T1133 — External Remote Services
• T1204.002 — Malicious File
• T1071 — Application Layer Protocol
• T1090.002 — External Proxy
• T1090 — Proxy
• T1059 — Command and Scripting Interpreter
• T1583.003 — Virtual Private Server
• T1204 — User Execution
• T1571 — Non-Standard Port
• T1027 — Obfuscated Files or Information
• T1486 — Data Encrypted for Impact
• T1573 — Encrypted Channel
• T1569 — System Services
• T1027.002 — Software Packing
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1090.001 — Internal Proxy