QNAP has told customers that attackers are breaching network-attached storage (NAS) devices through the Plex2Shell vulnerability chain. The vendor says it has received multiple reports of suspected compromises and that its Technical Support team is assisting affected users. The flaws reside in Plex Media Server, an application that users can install from the QNAP App Center to stream movies, TV shows, and music from their NAS drives.

The vulnerability chain

Plex2Shell is a chain of four vulnerabilities in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Security researcher Zach Main discovered the flaws and reported them to Plex on July 27. Exploitation began shortly after full technical details were published on October 16. On October 20, CISA added all four flaws to its Known Exploited Vulnerabilities catalog and directed federal agencies to upgrade to Plex 1.43.3.10861 or later within three days.

Scope of impact

QNAP’s Product Security Incident Response Team has confirmed that the vulnerabilities affect only Plex Media Server. QTS, QuTS hero, and other QNAP operating systems are not themselves affected.

Recommended actions

QNAP advises administrators to take the following steps:

  • Update Plex Media Server to version 1.43.3.10861, currently available through the QNAP App Center.
  • Treat the NAS and all personal content as compromised if a vulnerable Plex server was exposed to the public internet. Updating alone will not remove payloads that attackers have already installed.
  • Check for indicators of compromise listed in the security bulletin.
  • Perform a clean reinstall of the operating system (QTS or QuTS hero).
  • Reset Plex and NAS credentials.
  • Disable remote Plex features and stop forwarding port 32400 if remote access is not required.
  • Use a VPN for users who need remote access.

QNAP has published a step-by-step remediation guide and is offering to review logs from suspected compromises through its technical support portal.