QNAP says it has received reports that Plex Media Server on some of its network-attached storage (NAS) devices appears to have been compromised through the Plex2Shell vulnerability chain. The company said its technical support team is assisting affected users in a security notice published on November 6.
Plex2Shell combines four vulnerabilities in Plex Media Server 1.43.2 and earlier: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together, the flaws let an unauthenticated remote attacker execute code with the privileges of the Plex Media Server process. Plex’s official security update confirms the CVEs and says version 1.43.3.10861 and later are not affected. QNAP says the vulnerabilities affect Plex Media Server, not QNAP operating systems such as QTS or QuTS hero.
Plex says the flaws are being actively and widely exploited against internet-facing servers that have not been updated since proof-of-concept details became public on October 16. Compromised servers have been used to run cryptocurrency miners and proxy software that routes other people’s traffic through victims’ internet connections. QNAP has received reports of suspected compromises involving customer NAS devices but has not disclosed how many systems may be affected. BleepingComputer reported the vendor’s warning on November 6.
The fixed Plex Media Server release, version 1.43.3.10861 or later, is available through the QNAP App Center and follows Plex’s earlier 1.43.3 security update. QNAP says NAS devices running a vulnerable Plex server that was exposed to the public internet, along with their personal content, should be treated as compromised. The vendor also warned that installing the update will not remove payloads attackers may already have placed on a device.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
