QNAP NAS devices breached in Plex2Shell attacks
Original title: QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP advises users to update Plex Media Server to 1.43.3.10861 after suspected compromises via a chain of four vulnerabilities.
QNAP received reports of suspected compromises in Plex Media Server running on its NAS devices. The vulnerabilities form a Plex2Shell chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that CISA added to its KEV catalog. The flaws affect only Plex Media Server; QTS and QuTS hero operating systems remain unaffected. Users with exposed Plex servers should treat devices as compromised.
- Update Plex Media Server to version 1.43.3.10861 or later
- Check for compromise signs if Plex is publicly exposed
- Perform clean reinstall of QTS or QuTS hero if compromised
- Disable port 32400 or use VPN for remote access
Impact: compromise of network-attached storage devices
- 1.update to latest Plex version
- 2.check for signs of compromise
- 3.clean reinstall of OS if compromised
- Vendors
- QNAP
- Products
- Plex Media ServerQTSQuTS hero
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.