QNAP Warns of Plex2Shell Attacks on NAS Devices

QNAP says it has received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices running Plex Media Server. The company said its technical support team is assisting affected users.

Plex2Shell is a chain of four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Security researcher Zach Main reported the flaws to Plex on July 27. Exploitation began shortly after technical details became public on October 16. CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, and told federal agencies to upgrade to Plex 1.43.3.10861 or later within three days.

QNAP advises users to install the latest Plex Media Server version available in the QNAP App Center, currently 1.43.3.10861. QNAP says the vulnerabilities affect Plex Media Server, not QTS, QuTS hero or other QNAP operating systems.

The company says users with a vulnerable Plex server exposed to the public web should treat their NAS devices and personal content as compromised. Updating will not remove payloads already installed. QNAP recommends checking its security bulletin for signs of compromise, performing a clean reinstall of QTS or QuTS hero, and resetting Plex and NAS credentials. Users who do not need remote access should disable related features and stop forwarding port 32400. For remote access, QNAP advises using a VPN. The company also offers to review suspected-compromise logs submitted through its technical support portal.