QNAP has urged customers to update Plex Media Server on their network-attached storage (NAS) devices, saying it had received multiple reports of suspected compromises involving customers’ devices. Exploitation started shortly after full technical details became public on October 16. The company says users running a vulnerable Plex server exposed on the public web should treat their devices and all personal content as compromised.
QNAP said in an advisory that it had received multiple reports of suspected compromises and that its technical support team was assisting affected users. "QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users," the company said.
Plex2Shell is a chain of four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Security researcher Zach Main discovered the flaws and reported them to Plex on July 27. Exploitation began shortly after full technical details became public on October 16, and CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, urging federal agencies to upgrade to Plex 1.43.3.10861 or later within three days and giving the issue maximum priority.
QNAP's NAS devices are specialized computers with built-in storage used to store, access and share files across a network, typically for backups and media; Plex Media Server, installed from the QNAP App Center, streams movies, television shows and music from the drives. The company said the vulnerabilities were confined to that application. "The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected," it said.
QNAP advised users to update Plex Media Server to the latest version available in the App Center, currently 1.43.3.10861. But it warned that updating would not remove payloads attackers had already installed, and said users running a vulnerable Plex server exposed on the public web should treat their devices and all personal content as compromised. The vendor recommends checking the signs of compromise listed in its security bulletin, performing a clean reinstall of the operating system, and resetting Plex and NAS credentials. Users who do not need to access Plex remotely should disable the relevant features and stop forwarding port 32400, while those who need remote access to Plex are advised to connect via VPN. QNAP has published a step-by-step remediation guide and offers to investigate logs from suspected compromises, which users can submit through its technical support portal.
Analysis
Why This Matters
- Active exploitation: all four flaws were added to CISA's Known Exploited Vulnerabilities catalog days after technical details went public, and QNAP says it has received multiple reports of compromised devices.
- Hard to disinfect: QNAP warns that updating Plex will not remove payloads attackers have already planted, making a clean OS reinstall the recommended response.
- Devices hold personal data: NAS units are commonly used for backups and media, and QNAP says exposed devices and all personal content should be treated as compromised.
Background
QNAP NAS devices are specialized computers with built-in storage that let users store, access and share files across a network, often for backups and media. Plex Media Server, installed from the QNAP App Center, streams movies, television shows and music from the drives. The Plex2Shell chain comprises four vulnerabilities in Plex Media Server that security researcher Zach Main reported to Plex in July; exploitation began after full technical details were published in October, and CISA added all four to its known exploited vulnerabilities catalog the same month.
Key Perspectives
- QNAP: says users running a vulnerable Plex server exposed on the public web should treat their devices and all personal content as compromised, update Plex Media Server, and if compromise is suspected, reinstall the OS and reset credentials.
- CISA: added all four Plex2Shell flaws to its Known Exploited Vulnerabilities catalog and urged federal agencies to upgrade to Plex 1.43.3.10861 or later within three days.
What to Watch
- QNAP is offering to investigate logs from suspected compromises, which could reveal the scale of the attacks.
- Whether further breaches emerge now that technical details have been public since October 16 and CISA has flagged active use in the wild.
- Whether patched users still find infections: QNAP warns an update alone will not remove payloads already installed.
