CVE-2026-96656: Plex Media Server Arbitrary File Write Vulnerability Exploited In-The-Wild

Overview

CVE-2026-96656 is a high-severity arbitrary file write vulnerability in Plex Media Server, affecting versions prior to 1.43.3.10861. An authenticated admin user can exploit this to write arbitrary files, which are then executed upon server load. This vulnerability is being actively exploited in conjunction with other Plex vulnerabilities to deploy cryptominers such as XMRig, posing a significant resource hijacking and potential further compromise risk.

Technical Analysis

• Vulnerability ID: CVE-2026-96656
• Weakness Enumeration: CWE-73 (External Control of File Name or Path).
• Affected Products: Plex Media Server before 1.43.3.10861.
• Attack Vector: An authenticated admin user can manipulate the TranscoderH264Options preference.
• Exploitation Mechanism: The TranscoderH264Options preference is appended verbatim to x264’s option string during transcoding. This allows an attacker to inject arbitrary data into a file path or name, leading to the creation of arbitrary files.
• Code Execution: At startup, Plex Media Server loads and executes all .so (shared object) files without signature, execute bit, or symbol checks. By writing a malicious .so file to a directory Plex loads from, an attacker can achieve arbitrary code execution.
• Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655 to achieve broader impact, such as privilege escalation or bypassing other controls.
• CVSS 3.1 Score: 7.2 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Detection

• Monitor Plex Media Server log files for unusual TranscoderH264Options modifications or errors related to transcoding that indicate path manipulation attempts.
• Look for the creation of new or modified .so files in Plex Media Server installation directories, data directories (e.g., C:\ProgramData\Plex Media Server\ on Windows, /var/lib/plexmediaserver/ on Linux), or temporary directories (e.g., C:\Windows\Temp\, /tmp/).
• Monitor for unexpected child processes spawned by the Plex Media Server executable (e.g., Plex Media Server.exe, Plex Transcoder.exe) or its associated processes. Look for cmd.exe, powershell.exe, sh, bash, python, or known cryptominer executables (e.g., xmrig).
• Implement network monitoring to detect outbound connections from the Plex Media Server to known cryptomining pools, suspicious IP addresses, or C2 infrastructure.
• Utilize File Integrity Monitoring (FIM) on critical Plex Media Server directories to detect unauthorized file changes or creations.

Sigma Detection Rules

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 9381e4b3-c15b-4b1a-8e2a-1f2d3c4e5f6a
status: experimental
description: Detects suspicious process creation by Plex Media Server, indicative of post-exploitation activity after arbitrary file write.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection
level: high

Plex Media Server Suspicious Shared Object File Creation

title: Plex Media Server Suspicious Shared Object File Creation
id: 7a2b0c1d-e3f4-5g6h-7i8j-9k0l1m2n3o4p
status: experimental
description: Detects the creation of new .so files in potentially exploitable locations by Plex Media Server, which could indicate arbitrary file write exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '.so'
    Image|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    TargetFilename|contains:
      - 'C:\ProgramData\Plex Media Server\'
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
  condition: selection
level: high

XMRig Cryptominer Process Activity

title: XMRig Cryptominer Process Activity
id: 5d6e7f8a-9b0c-1d2e-3f4a-5b6c7d8e9f0a
status: experimental
description: Detects common process creation patterns associated with XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-96656.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_img:
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmd:
    CommandLine|contains:
      - '--donate-level'
      - '--url'
      - '--user'
      - '--pass'
      - '-o stratum+tcp://'
      - '-a rx/0'
      - '-k --nicehash'
  condition: 1 of selection_*
level: high

Mitigations

1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes for the latest security updates.
2. Restrict Admin Access: Limit administrative access to Plex Media Server to only trusted and authorized personnel.
3. Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment to limit lateral movement and impact in case of compromise.
4. Monitor Outbound Connections: Implement egress filtering on network firewalls to prevent unauthorized outbound connections from the Plex Media Server, particularly to known cryptomining ports or suspicious IP ranges.
5. Regular Backups: Maintain regular backups of Plex Media Server configurations and data to facilitate recovery from potential compromise.

References

• https://forums.plex.tv/t/plex-media-server/30447/711
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-96656
• https://zmain.info/blog/plex2shell
• https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656

Indicators of Compromise

MITRE ATT&CK

• T1059.001 — PowerShell
• T1059.003 — Windows Command Shell
• T1574.002 — DLL Side-Loading
• T1496 — Resource Hijacking
• T1036.005 — Match Legitimate Resource Name or Location
• T1583 — Acquire Infrastructure
• T1133 — External Remote Services
• T1204.002 — Malicious File
• T1071 — Application Layer Protocol
• T1190 — Exploit Public-Facing Application
• T1090.002 — External Proxy
• T1090 — Proxy
• T1059 — Command and Scripting Interpreter
• T1583.003 — Virtual Private Server
• T1204 — User Execution
• T1571 — Non-Standard Port
• T1027 — Obfuscated Files or Information
• T1486 — Data Encrypted for Impact
• T1573 — Encrypted Channel
• T1569 — System Services
• T1027.002 — Software Packing
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1090.001 — Internal Proxy