Plex2Shell chain exploited against QNAP NAS users
Original title: Plex2Shell Exploited Against QNAP NAS Users
Four vulnerabilities in Plex Media Server were chained for remote code execution on exposed devices.
Threat actors are exploiting a chain of four vulnerabilities (CVE-2026-96652 through CVE-2026-96656) in Plex Media Server running on QNAP NAS devices. The flaws were patched this summer but PoC code was released in mid-October. Successful exploitation allows arbitrary code execution with Plex service privileges on internet-facing servers. QNAP advises updating to version 1.43.3 or later, rotating passwords and reinstalling Plex if needed.
Unconfirmed: No data loss reported
- Chain requires no valid credentials
- Devices accessible from the internet are at risk
- Passwords for Plex and NAS must be rotated
- Vendors
- QNAP
- Products
- Plex Media ServerQNAP NAS
- Victims
- QNAP NAS users
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |
From the original article
2 min read at securityweek.com
Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices. The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.