Detect Plex Media Server SSRF Exploitation (CVE-2026-96652) in Sumo Logic CSE
Detects exploitation of CVE-2026-96652, a Server-Side Request Forgery (SSRF, CWE-918) vulnerability in Plex Media Server v1.43.2 and earlier. An attacker who can reach the Plex web/API surface can coerce the server into issuing attacker-controlled outbound HTTP requests, enabling access to internal services, cloud instance metadata endpoints (e.g. 169.254.169.254), and localhost-bound admin interfaces. This CVE is listed in CISA KEV (BOD 26-04), indicating active in-the-wild exploitation. This detection surfaces anomalous server-initiated outbound connections from the Plex Media Server process to internal/metadata/loopback ranges and suspicious inbound API requests containing URL-like parameters, which are the hallmark of SSRF abuse.
MITRE ATT&CK
- Tactic
- Collection Discovery
Sumo Detection Query
_sourceCategory=*endpoint* OR _sourceCategory=*network*
| where process_name matches "Plex Media Server*"
| where dest_ip in ("169.254.169.254","169.254.170.2","127.0.0.1","::1")
or compareCIDRPrefix("10.0.0.0", dest_ip, toInt(8))
or compareCIDRPrefix("172.16.0.0", dest_ip, toInt(12))
or compareCIDRPrefix("192.168.0.0", dest_ip, toInt(16))
or dest_port in (2375,6443,9200,8080)
| count as conn_count, min(_messagetime) as first_seen, max(_messagetime) as last_seen by host, process_name, dest_ip, dest_port, user
| sort by last_seen descSurfaces Plex Media Server process outbound connections to metadata/internal/loopback destinations consistent with SSRF.
Data Sources
Required Tables
False Positives & Tuning
- Plex LAN media device discovery
- Loopback traffic to co-located services
- Internal infrastructure agents on the host network
Other platforms for CVE-2026-96652
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate SSRF to cloud metadata endpoint
Expected signal: Outbound NetworkConnect event to 169.254.169.254 on port 80 from the issuing process
- Test 2 Simulate SSRF internal port scan to loopback service
Expected signal: Multiple loopback NetworkConnect events to administrative ports in a short window
- Test 3 Windows SSRF metadata fetch simulation
Expected signal: DeviceNetworkEvents ConnectionSuccess to 169.254.169.254 from the initiating process
References (4)
- https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-96652
Response Playbook
Triage
- Confirm the Plex Media Server version on the affected host; versions <= v1.43.2 are vulnerable to CVE-2026-96652 and must be prioritized per CISA BOD 26-04.
- Review the flagged outbound connection(s): identify the destination (cloud metadata 169.254.169.254, loopback, or internal service) and whether it maps to any legitimate Plex LAN/library scanning behavior.
- Correlate the outbound server-side fetch with the preceding inbound HTTP/API request to the Plex web surface to find the request that triggered the SSRF (URL-like parameters, redirects, or crafted library/media paths).
- Determine whether the destination was a sensitive internal target (metadata credential endpoint, Docker socket 2375, Kubernetes API 6443, Elasticsearch 9200).
Containment
- Isolate or network-segment the Plex host to block arbitrary outbound server-initiated traffic, especially to 169.254.169.254 and internal management ports.
- Upgrade Plex Media Server to a fixed release (newer than v1.43.2) immediately; if patching is delayed, restrict the Plex web/API surface to trusted networks via firewall/reverse-proxy allowlist.
- Block egress from the Plex host to cloud metadata IPs and internal admin service ports at the host or network firewall.
Evidence Collection
- Preserve Plex Media Server logs (Plex Media Server/Logs/) including access and transcoder logs showing the triggering request and timestamps.
- Capture EDR/network flow records for all outbound connections initiated by the Plex process in the exploitation window, including destination IPs, ports, and byte counts.
- If a cloud metadata endpoint was contacted, snapshot the instance's IAM role/credentials and audit CloudTrail/activity logs for any use of exfiltrated credentials.
Escalation Criteria
- !Escalate to IR immediately if the Plex process successfully reached a cloud metadata endpoint (169.254.169.254) or an internal credential/admin service, as credential theft or lateral movement may have occurred.
- !Escalate if evidence shows the SSRF was chained to internal service access (Docker socket, Kubernetes API, databases) or if exfiltrated cloud credentials were subsequently used.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Plex Media Server access/transcoder logs showing crafted requests with URL-like parameters - >
EDR NetworkConnect records attributing outbound connections to the Plex process - >
Cloud provider metadata-access and subsequent CloudTrail/activity events if credentials were reached
Tuning Guidance
Baseline the normal set of internal/LAN IPs that Plex legitimately contacts for DLNA/media device discovery and library scanning, then exclude those well-known destinations. Keep metadata IPs (169.254.169.254/169.254.170.2) and sensitive admin ports (2375/6443/9200) unexcluded as they have no legitimate Plex use. Narrow the RFC1918 match to destinations outside the host's local subnet to cut LAN-scan noise, and raise confidence when the outbound fetch directly follows an inbound API request with URL parameters.
Hunting Queries
Hunt for any Plex process outbound connections to the cloud metadata endpoint or loopback, which have no legitimate Plex use case.
DeviceNetworkEvents | where InitiatingProcessFileName has "Plex Media Server" | where RemoteIP == "169.254.169.254" or RemoteIP startswith "127." | summarize count() by DeviceName, RemoteIP, RemotePort, bin(Timestamp, 1h)index=* process_name="Plex Media Server*" (dest_ip="169.254.169.254" OR dest_ip="127.0.0.1") | stats count by host, dest_ip, dest_portAtomic Red Team Tests
Issues an outbound HTTP request to the cloud instance metadata IP from the host to emulate the SSRF server-side fetch primitive.
Command
curl -s -m 5 http://169.254.169.254/latest/meta-data/iam/security-credentials/ || trueCleanup
echo 'no cleanup required (read-only request)'Expected Telemetry
Outbound NetworkConnect event to 169.254.169.254 on port 80 from the issuing process
Expected Detection
KQL/SPL/EDR rules flag an outbound connection to the metadata endpoint; if executed by the Plex process, the primary rule fires.
Connects to a loopback-bound administrative port to emulate SSRF-driven internal service discovery.
Command
for p in 2375 6443 9200 8080; do curl -s -m 2 http://127.0.0.1:$p/ || true; doneCleanup
echo 'no cleanup required'Expected Telemetry
Multiple loopback NetworkConnect events to administrative ports in a short window
Expected Detection
Detection surfaces loopback/internal admin-port connections attributed to the server process.
Uses PowerShell to issue an outbound request to the cloud metadata endpoint to emulate the SSRF fetch on a Windows Plex host.
Command
powershell -c "try { Invoke-WebRequest -Uri 'http://169.254.169.254/latest/meta-data/' -TimeoutSec 5 -UseBasicParsing } catch {}"Cleanup
powershell -c "echo 'no cleanup required'"Expected Telemetry
DeviceNetworkEvents ConnectionSuccess to 169.254.169.254 from the initiating process
Expected Detection
KQL DeviceNetworkEvents rule flags the outbound metadata connection.