CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — four vulnerabilities in Plex Media Server collectively dubbed "Plex2Shell" — are being exploited in attacks that QNAP says have led to suspected compromises of network-attached storage (NAS) devices.
Plex2Shell and the CVE chain
Plex2Shell is a linked chain of four flaws in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Security researcher Zach Main discovered and reported the flaws to Plex on July 27. The full technical details were published on October 16, and exploitation began shortly after those details became public.
Plex issued fixes in Plex 1.43.3.10861; QNAP and CISA both reference that version as the remediation target. QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center — currently 1.43.3.10861 — to defend against Plex2Shell attacks.
QNAP's findings and affected devices
QNAP said it has received multiple reports of suspected compromises involving customers’ NAS devices and that its technical support is assisting affected users. The QNAP Product Security Incident Response Team (QNAP PSIRT) confirmed the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero and other QNAP operating systems are not themselves affected.
QNAP’s advisory reminds users that NAS devices are specialized computers with built-in storage used to back up computers and store media, and that many users expand device capabilities by installing apps from the QNAP App Center — such as Plex Media Server, which streams movies, TV shows and music directly from NAS drives. QNAP is treating infections tied to a vulnerable Plex install as a device-level threat to the NAS and to the personal content stored on it.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRemediation steps QNAP recommends
QNAP’s guidance is direct and procedural: update Plex Media Server through the QNAP App Center to version 1.43.3.10861 (or later); but do not expect an update alone to cure a device already breached. The vendor explicitly warns that applying the update will not remove any payloads attackers may have installed.
- Users running a vulnerable, publicly exposed Plex server should treat their NAS and all personal content as compromised.
- QNAP recommends checking for the signs of compromise listed in its security bulletin, performing a clean reinstall of the NAS operating system (QTS or QuTS hero), and resetting Plex and NAS credentials.
- Users who do not require remote Plex access should disable those features and stop forwarding TCP port 32400; users who do need remote access are advised to connect via VPN instead of exposing Plex directly to the public internet.
- QNAP has published a step‑by‑step remediation guide and offers to investigate logs from suspected compromises submitted through the company’s technical support portal.
CISA response and federal guidance
The Cybersecurity and Infrastructure Security Agency added all four Plex2Shell flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026. CISA urged federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, assigning the listing maximum priority under its guidance.
What this means for technologists and end users
Technologists and security teams should assume that exposed, vulnerable Plex instances may already have been used to place persistent payloads: QNAP advises that updating alone will not remove such payloads and recommends a clean OS reinstall and credential rotation. Teams that manage QNAP fleets will want to audit for forwarded port 32400, examine logs for indicators described in QNAP’s bulletin, and consider QNAP’s offer to analyze logs submitted through its support portal.
End users must act on two fronts: first, update Plex Media Server in the QNAP App Center to 1.43.3.10861 or later; second, follow QNAP’s remediation steps if a NAS with an exposed Plex server might have been breached — disable remote Plex features or switch remote access to a VPN, perform the OS reinstall prescribed by QNAP, and reset Plex and NAS credentials.
QNAP has acknowledged multiple suspected compromises and is assisting affected customers, while CISA has given the Plex2Shell chain maximum priority for federal systems. The technical fix is available; QNAP’s warning is clear: patching stops new exploitation but does not automatically evict attackers already inside. For NAS owners who exposed Plex to the public internet, the immediate choices are simple and stark — update and follow QNAP’s cleanup steps, or assume the device and content are compromised.
