QNAP says Plex2Shell flaws are used to compromise NAS devices
Original title: QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices
Users should move Plex Media Server to 1.43.3.10861 or later; exposed 1.43.2 installs may need a clean reinstall.
QNAP warned that some users’ NAS devices running Plex Media Server were compromised through the Plex2Shell chain. QNAP PSIRT said the flaws are only in Plex Media Server, not QTS, QuTS hero, or other QNAP operating systems. Researcher Zach Main published details and proof-of-concept code on October 16, 2026, for CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Attackers were seen using the chain within a day, and CISA added the flaws to KEV on October 20.
Unconfirmed: QNAP cites user reports of compromise and is assisting affected users; the number of victims is not stated.
- The chain can run arbitrary code as the Plex service without valid credentials when conditions are met.
- Plex was notified July 27 and shipped fixes in September, before public exploit code.
- Honeypot attacks deployed cryptocurrency-mining malware and proxy software.
- Update through App Center to 1.43.3 or later and confirm 1.43.3.10861 or later.
- Federal agencies were told to address the KEV entries by October 23, 2026.
Impact: Unauthenticated code execution as the Plex service account
| Product | Affected | Fixed in |
|---|---|---|
| Plex Media Server | 1.43.2 or earlier | 1.43.3 or later (1.43.3.10861 or later) |
- 1.Update Plex Media Server to 1.43.3 or later and confirm 1.43.3.10861 or later.
- 2.If version 1.43.2 or earlier was internet-reachable, clean-reinstall and reset Plex and NAS credentials.
- 3.Disable unneeded Plex Remote Access and do not forward port 32400; use a VPN instead.
- Products
- Plex Media ServerQTSQuTS hero
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |
From the original article
3 min read at securityaffairs.comTaiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain. QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices. “QNAP has received reports from some users that […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.