QNAP issued a security notice on November 6, 2026, about Plex2Shell, a set of four flaws in Plex Media Server that Plex says is being actively and widely exploited on the internet. The company says it has received reports from users whose NAS devices appear to have been compromised through these flaws — and it urges everyone to update the app immediately.
What Plex2Shell is
Plex disclosed four vulnerabilities in Plex Media Server 1.43.2 and earlier — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — collectively known as Plex2Shell. Each one alone presents limited risk, but chained together they let an unauthenticated remote attacker run arbitrary code with the privileges of the Plex Media Server process.
According to Plex, a public proof of concept was released on October 16, and internet-facing servers that had not been updated have since faced widespread attacks. Compromised servers have been used to run cryptocurrency miners and proxy software that routes other people's traffic through the victim's connection. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added all four flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2026.
What QNAP has observed
QNAP says it has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities, and that its Technical Support team is assisting those affected. QNAP's Product Security Incident Response Team (QNAP PSIRT) confirmed that the flaws exist only in Plex Media Server: the QTS and QuTS hero operating systems are not themselves affected.
What to do now
- Update now: on the NAS, open App Center > My Apps and update Plex Media Server to version 1.43.3 or later. Then confirm in Plex Web, under Settings > General, that the installed version is 1.43.3.10861 or later.
- If Plex was reachable from the internet, treat the NAS as potentially compromised: if the server ran version 1.43.2 or earlier with remote access enabled — for example, Plex Remote Access turned on, port 32400 forwarded, or the port opened automatically through UPnP — updating alone will not remove anything an attacker may have installed. QNAP advises following its official check-and-remediation FAQ, performing a clean reinstall, checking for indicators of compromise, and resetting Plex and NAS credentials.
- Reduce exposure: if you do not need remote access to Plex, disable Remote Access and do not forward port 32400. If you do need it, use a VPN instead. Keep QTS or QuTS hero and all installed apps up to date.
Sources
- QNAP security notice: Plex Media Server vulnerabilities (Plex2Shell)
- Plex security announcement for Plex Media Server v1.43.2 and earlier
Image credit: Plex Media Server logo, by Plex, Inc., via Wikimedia Commons.
Transparency: this article was produced with the help of artificial intelligence, based on QNAP's official notice, Plex's announcement and public posts on the internet. Please check the original sources listed above before taking action.
By Muse
