Plex Media Server SSRF Exploitation (CVE-2026-96652)

let MetadataRanges = dynamic(["169.254.169.254", "169.254.170.2", "127.0.0.1", "::1"]);
let InternalCidrs = dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]);
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("Plex Media Server.exe", "Plex Media Server", "PlexMediaServer")
| where ActionType == "ConnectionSuccess"
| where RemoteIP in (MetadataRanges)
    or ipv4_is_in_any_range(RemoteIP, InternalCidrs)
    or RemotePort in (169, 80, 8080, 443, 2375, 6443, 9200)
| where RemoteIP != LocalIP
| summarize ConnCount = count(), Ports = make_set(RemotePort), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, InitiatingProcessAccountName
| where ConnCount >= 1
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIP, Ports, ConnCount
| order by LastSeen desc

index=network OR index=edr sourcetype IN ("stream:tcp","sysmon","XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
(process_name="Plex Media Server*" OR Image="*Plex Media Server*")
(EventCode=3 OR tag=network)
| eval dest_is_metadata=if(dest_ip IN ("169.254.169.254","169.254.170.2","127.0.0.1","::1"),1,0)
| eval dest_is_internal=if(cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip),1,0)
| where dest_is_metadata=1 OR dest_is_internal=1 OR dest_port IN (2375,6443,9200,8080)
| stats count AS conn_count values(dest_port) AS dest_ports min(_time) AS first_seen max(_time) AS last_seen by host, process_name, dest_ip, user
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

sequence by host.name with maxspan=5m
  [ network where process.name : ("Plex Media Server*", "PlexMediaServer") and
    (
      destination.ip == "169.254.169.254" or
      destination.ip == "169.254.170.2" or
      destination.ip == "127.0.0.1" or
      cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
    ) and
    destination.port in (80, 443, 8080, 2375, 6443, 9200)
  ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, destinationport, "Process Name" AS process, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE "Process Name" ILIKE '%Plex Media Server%'
AND (
  destinationip = '169.254.169.254'
  OR destinationip = '169.254.170.2'
  OR destinationip = '127.0.0.1'
  OR INCIDR('10.0.0.0/8', destinationip)
  OR INCIDR('172.16.0.0/12', destinationip)
  OR INCIDR('192.168.0.0/16', destinationip)
  OR destinationport IN (2375, 6443, 9200)
)
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=*endpoint* OR _sourceCategory=*network*
| where process_name matches "Plex Media Server*"
| where dest_ip in ("169.254.169.254","169.254.170.2","127.0.0.1","::1")
    or compareCIDRPrefix("10.0.0.0", dest_ip, toInt(8))
    or compareCIDRPrefix("172.16.0.0", dest_ip, toInt(12))
    or compareCIDRPrefix("192.168.0.0", dest_ip, toInt(16))
    or dest_port in (2375,6443,9200,8080)
| count as conn_count, min(_messagetime) as first_seen, max(_messagetime) as last_seen by host, process_name, dest_ip, dest_port, user
| sort by last_seen desc

rule plex_ssrf_cve_2026_96652 {
  meta:
    author = "Argus"
    description = "Plex Media Server SSRF outbound to metadata/internal endpoints (CVE-2026-96652)"
    severity = "HIGH"
  events:
    $e.principal.process.file.full_path = /Plex Media Server/ nocase
    $e.network.ip_protocol = "TCP"
    (
      $e.target.ip = "169.254.169.254" or
      $e.target.ip = "169.254.170.2" or
      $e.target.ip = "127.0.0.1" or
      net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8") or
      net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12") or
      net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
    )
  condition:
    $e
}

#event_simpleName=NetworkConnectIP4
| ImageFileName=/\\Plex Media Server\.exe$/i OR ImageFileName=/Plex Media Server$/i
| in(RemoteAddressIP4, values=["169.254.169.254","169.254.170.2","127.0.0.1"])
  OR cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])
  OR in(RemotePort, values=["2375","6443","9200","8080"])
| groupBy([aid, ComputerName, ImageFileName, RemoteAddressIP4], function=[count(as=conn_count), collect([RemotePort])])
| sort(conn_count, order=desc)