QNAP says it has received reports from some customers that Plex Media Server running on their NAS (network-attached storage) devices was compromised through the Plex2Shell vulnerability chain, and that its support team is helping the affected users. We covered the Plex2Shell attacks on 19 October, when attackers were installing cryptominers and a proxy backdoor on exposed servers. QNAP’s notice reports that the attacks have now reached QNAP NAS owners.
Plex2Shell is a chain of four flaws in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) that lets an unauthenticated attacker run code with the privileges of the Plex process. QNAP’s PSIRT says the flaws are in Plex Media Server only; QTS, QuTS hero and other QNAP operating systems are not themselves affected. BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities catalog on 20 October.
The point QNAP stresses is that patching is not enough for a server that was exposed. If Plex on your NAS could be reached from the internet while running version 1.43.2 or earlier, updating will not remove anything an attacker already installed, and QNAP says to treat the NAS as potentially compromised.
How to check if you’re affected
Affected products are QNAP NAS devices running Plex Media Server 1.43.2 or earlier, per QNAP. The risk is highest if Plex Remote Access was enabled, port 32400 was forwarded, or the port was opened automatically through UPnP or router auto-configuration.
- In App Center > My Apps, update Plex Media Server to 1.43.3 or later, then confirm in Plex Web under Settings > General that the version is 1.43.3.10861 or later.
- If the server was internet-reachable on 1.43.2 or earlier, follow QNAP’s Plex2Shell check-and-remediation FAQ to look for signs of compromise, do a clean reinstall (BleepingComputer describes this as reinstalling the NAS operating system, QTS or QuTS hero) and reset your Plex and NAS credentials.
- If you suspect a compromise and want QNAP to confirm it, preserve the Plex Logs folder before removing Plex Media Server, then open a case with QNAP Technical Support.
- If you do not need remote access to Plex, disable Plex Remote Access and do not forward port 32400. If you do need it, QNAP says to use a VPN instead. Also make sure QTS or QuTS hero and all installed apps are up to date.
QNAP’s notice does not say how many devices were hit. Its step-by-step FAQ page returned an empty response to our checker, so the remediation steps above are taken from QNAP’s security notice and BleepingComputer.
Sources
- QNAP Security Notice: Plex Media Server Vulnerabilities (Plex2Shell) – Update to 1.43.3.10861 or Later Immediately
- QNAP: Plex2Shell check and remediation FAQ for QNAP NAS users (page returned no content to our checker; not read)
- zmain.info: Plex2Shell, unauthenticated RCE in Plex Media Server
- BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks