Summary
QNAP says it has received reports of NAS devices compromised through Plex2Shell, a chain of four vulnerabilities in Plex Media Server. The company urges users to update Plex to the latest version in the QNAP App Center. QNAP's PSIRT states the flaws exist only in Plex Media Server, so QTS and QuTS hero are not affected.
The Vulnerabilities
Plex2Shell chains four flaws:
- CVE-2026-96652
- CVE-2026-96654
- CVE-2026-96655
- CVE-2026-96656
Researcher Zach Main reported them to Plex on July 27. Exploitation began shortly after full technical details were published on October 16. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20, 2026 and gave federal agencies three days to upgrade.
The source article does not list the vulnerable version range or the payloads attackers are installing.
Impact
Exposed Plex servers are an easy route onto a home or small-business NAS, where family media, backups, and shared files often sit on the same device. QNAP warns that updating does not remove payloads that attackers have already installed.
What to Do
- Update Plex Media Server to 1.43.3.10861 or later through the QNAP App Center.
- If a vulnerable Plex server was reachable from the internet, treat the NAS and its content as compromised.
- Check for compromise using the indicators in QNAP's security bulletin.
- Reinstall QTS or QuTS hero cleanly, then reset Plex and NAS credentials.
- If you do not need remote Plex access, disable the related features and stop forwarding port 32400.
- If you do need remote access, use a VPN rather than exposing the port.
- QNAP technical support can analyze logs from suspected compromises.
Sources
- BleepingComputer, "QNAP says hackers breaching NAS devices in Plex2Shell attacks" (November 6, 2026)