CVE-2026-96654: Plex Media Server URI Scheme Neutralization Vulnerability Exploited for Cryptomining

Overview

Plex Media Server is affected by CVE-2026-96654, a medium-severity vulnerability allowing attackers to manipulate URI schemes to call internal plugin functions. This flaw can be chained with other vulnerabilities to achieve remote code execution. Threat actors are actively exploiting this to deploy cryptomining malware, making immediate patching critical for affected organizations and users.

Technical Analysis

• CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page.
• Description: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne, allowing an attacker to call other plugins’ functions and supply their own parameters.
• CVSS 3.1: 6.5 (Medium) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates network access, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.
• Weakness: CWE-84 (Improper Neutralization of Input During Web Page Generation).
• Affected Versions: Plex Media Server versions prior to 1.43.0.10861.
• Attack Vector: Network-based, unauthenticated. Exploitation involves crafting malicious URI requests to the Plex Media Server.
• Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, potentially escalating impact to remote code execution.
• Observed Impact: Active exploitation has been observed, leading to the deployment of cryptominer malware (e.g., XMRig) and proxy software (myawesomeproxy).

Detection

• Monitor Plex Media Server process (Plex Media Server.exe) for unusual child process creation (e.g., cmd.exe, powershell.exe, wscript.exe, cscript.exe, or known cryptominer executables like xmrig.exe or myawesomeproxy.exe).
• Inspect web server access logs for Plex Media Server for requests containing searchOne with unusual or encoded parameters, especially those attempting to invoke internal plugin functions.
• Look for outbound network connections from the Plex Media Server process to known cryptomining pools or unusual IP addresses/ports.
• Scan for the presence of known cryptominer executables (xmrig.exe) or proxy software (myawesomeproxy.exe) in unexpected directories, particularly within the Plex installation path or temporary directories.

Sigma Detection Rules

Plex Media Server Spawning Suspicious Child Process

title: Plex Media Server Spawning Suspicious Child Process
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes (e.g., cmd, powershell, cryptominers) spawned by Plex Media Server, indicating potential exploitation of CVE-2026-96654 or similar vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\Plex Media Server.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\xmrig.exe'
      - '\myawesomeproxy.exe'
  condition: selection
level: high

XMRig Cryptominer Process Creation

title: XMRig Cryptominer Process Creation
id: 1f2e3d4c-5b6a-7f8e-9d0c-1b2a3f4e5d6c
status: experimental
description: Detects the creation of the XMRig cryptominer process, often deployed after successful exploitation of vulnerabilities like CVE-2026-96654.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\xmrig.exe'
  condition: selection
level: high

Mitigations

1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes.
2. Network Segmentation: Isolate Plex Media Server instances from critical internal networks.
3. Restrict Outbound Connectivity: Implement firewall rules to limit outbound connections from the Plex Media Server to only necessary services, blocking access to known cryptomining pools.
4. Principle of Least Privilege: Ensure the Plex Media Server runs with the minimum necessary user permissions.
5. Regular Audits: Periodically review Plex Media Server logs and system activity for signs of compromise.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-96654
• https://forums.plex.tv/t/plex-media-server/30447/711
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-96654
• https://zmain.info/blog/plex2shell
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
• https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

MITRE ATT&CK

• T1059.003 — Windows Command Shell
• T1059.001 — PowerShell
• T1496 — Resource Hijacking
• T1583 — Acquire Infrastructure
• T1133 — External Remote Services
• T1204.002 — Malicious File
• T1071 — Application Layer Protocol
• T1190 — Exploit Public-Facing Application
• T1090.002 — External Proxy
• T1090 — Proxy
• T1059 — Command and Scripting Interpreter
• T1583.003 — Virtual Private Server
• T1204 — User Execution
• T1571 — Non-Standard Port
• T1027 — Obfuscated Files or Information
• T1486 — Data Encrypted for Impact
• T1573 — Encrypted Channel
• T1569 — System Services
• T1027.002 — Software Packing
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1090.001 — Internal Proxy