CVE-2026-96652 'Plex2Shell': CISA KEV Order — Detecting and Remediating the Plex Media Server SSRF Vulnerability

---
title: Plex Media Server Outbound Connection to Internal or Metadata Endpoints
id: 3f8a2c91-6d44-4e1b-b2a7-9c5e1f7d3a02
status: experimental
description: Detects Plex Media Server initiating outbound connections to RFC1918, link-local, or cloud metadata addresses — a strong indicator of SSRF exploitation (CVE-2026-96652 / Plex2Shell). Plex legitimately communicates with plex.tv infrastructure, not internal hosts.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\Plex Media Server.exe'
      - '\PlexScriptHost.exe'
      - '\Plex Transcoder.exe'
  selection_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '169.254.'
  filter_metadata_ip:
    DestinationIp: '169.254.169.254'
  condition: selection_process and selection_internal
falsepositives:
  - Plex DLNA/local client streaming on the same subnet — baseline normal subnet traffic and scope the rule to unexpected segments and ports
level: high
---
title: Suspicious Child Process Spawned by Plex Media Server
id: 8b1d4e60-2f7a-4c39-a5d1-6e9b3c8f2a14
status: experimental
description: Detects Plex Media Server spawning command interpreters or scripting engines, consistent with post-exploitation following a Plex2Shell chain. Plex should not launch cmd, PowerShell, bash, or python under normal operation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Plex Media Server.exe'
      - '\PlexScriptHost.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Third-party Plex plugins or scripts invoking system tools — rare; investigate any hit
level: critical

// Hunt: Plex Media Server outbound connections to internal/metadata addresses
// Requires Sysmon/network telemetry or CEF-ingested firewall logs in Sentinel
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("Plex Media Server", "PlexScriptHost", "PlexTranscoder", "Plex Media Server.exe")
| where RemoteIP startswith "10." or RemoteIP startswith "192.168."
    or (RemoteIP startswith "172." and toint(split(RemoteIP, ".")[1]) between (16 .. 31))
    or RemoteIP == "169.254.169.254"
| summarize ConnectionCount = count(), DistinctTargets = dcount(RemoteIP),
    Ports = make_set(RemotePort), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteIP
| order by ConnectionCount desc

// Complementary hunt: Plex process spawning shells or LOLBins (post-exploitation behavior)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("Plex Media Server.exe", "PlexScriptHost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

-- Plex2Shell triage: enumerate Plex processes, their children, and network connections
-- Deploy as a hunt across endpoints hosting Plex Media Server

LET plex_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)plex'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM plex_procs)
   OR Name =~ '(?i)plex'

-- Plex SSRF indicator: active connections from Plex processes to internal ranges
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ '(?i)plex'
  AND (Raddr.IP =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)')

#!/bin/bash
# Plex2Shell / CVE-2026-96652 triage and hardening script (Linux/NAS)
# 1) Identify Plex installs and versions
# 2) Check exposure of TCP 32400
# 3) Audit outbound connections from Plex to internal ranges

set -u

echo "=== Plex Media Server presence and version ==="
if command -v systemctl >/dev/null 2>&1; then
  systemctl list-units --type=service | grep -i plex
fi
PLEX_BIN=$(find /usr/lib/plexmediaserver /opt /snap -maxdepth 4 -name "Plex Media Server" -type f 2>/dev/null | head -1)
if [ -n "$PLEX_BIN" ]; then
  echo "Plex binary: $PLEX_BIN"
  grep -a -o 'PlexMediaServer/[0-9.]*' /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Logs/*.log 2>/dev/null | tail -1
cat /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Preferences.xml 2>/dev/null | grep -o 'PlexOnlineToken' >/dev/null && echo "[!] Authenticated Plex token present — rotate after patching"
fi

echo ""
echo "=== Listening exposure on 32400 ==="
ss -tlnp 2>/dev/null | grep 32400 && echo "[!] Plex is listening — verify it is not bound to 0.0.0.0 or NAT-forwarded"

echo ""
echo "=== Outbound connections from Plex to internal/metadata ranges ==="
PLEX_PIDS=$(pgrep -f -i plex | tr '\n' ',' | sed 's/,$//')
if [ -n "$PLEX_PIDS" ]; then
  ss -tnp 2>/dev/null | grep -E "pid=(${PLEX_PIDS//,/|})" | grep -E '(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)'
fi

echo ""
echo "=== Egress hardening recommendation ==="
echo "Block Plex egress to internal ranges (example nftables):"
echo "  nft add rule inet filter output ip daddr 169.254.169.254 meta skuid plex drop"
echo "  nft add rule inet filter output ip daddr 10.0.0.0/8 meta skuid plex drop"
echo "Review and adapt to your actual topology before applying."