QNAP is urging users to immediately update Plex Media Server on their network-attached storage (NAS) devices after receiving multiple reports of possible compromises linked to the Plex2Shell vulnerability chain. The company warns that updating the software will not remove malicious payloads that attackers may already have installed, and recommends affected users follow a full remediation process.
QNAP reports possible Plex2Shell compromises
QNAP said some customers reported that Plex Media Server running on their NAS devices appeared to have been compromised. The company’s technical support team is assisting affected users.
“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised,” the vendor said in a security advisory.
Plex2Shell is a chain of four vulnerabilities in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Security researcher Zach Mayne discovered and reported the vulnerabilities. Exploitation began shortly after full technical details were published on October 16.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added all four vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026. The agency asked federal agencies to prioritize upgrading to Plex Media Server version 1.43.3.10861 or later within three days.
Update Plex Media Server immediately
QNAP recommends updating Plex Media Server to the latest version available through the QNAP App Center. At the time of the advisory, that version was 1.43.3.10861.
QNAP NAS devices are computers with built-in storage that allow users to store, access and share files over a network. They are commonly used for computer backups and media storage. Users can expand their functionality by installing applications such as Plex Media Server, which streams movies, television shows and music directly from the NAS.
QNAP’s Product Security Incident Response Team confirmed that the vulnerability affects Plex Media Server only. The company said that QTS, QuTS hero and other QNAP operating systems are not affected.
What affected users should do
QNAP says users running a vulnerable Plex server that was exposed to the public internet should treat both the NAS device and all personal content stored on it as compromised.
Installing the latest Plex update will not remove payloads that attackers may have placed on the device before the update. QNAP recommends that users:
- Check for indicators of compromise listed in the company’s security bulletin.
- Perform a clean reinstall of the QTS or QuTS hero operating system.
- Reset Plex and NAS account credentials.
- Disable Plex remote-access features if they are not needed.
- Stop forwarding port 32400 from the internet to the NAS.
QNAP recommends that users who require remote Plex access connect through a virtual private network (VPN) rather than exposing the service directly to the public internet.
The company has also published a step-by-step repair guide covering the recommended checks and remediation process. Users who suspect a compromise can submit relevant logs through QNAP’s technical support portal for investigation.
Source: www.bleepingcomputer.com