QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.
The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices.
"QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users,” the company says in an advisory today.
Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16.
CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, giving it maximum priority.
QNAP’s NAS devices are specialized computers with built-in storage that allow users to store, access, and share files across a network. They are typically used to back up computers and store media files.
Users can also expand their devices' capabilities by installing applications from the QNAP App Center, such as Plex Media Server, which streams movies, TV shows, and music directly from NAS drives.
QNAP advises users to update Plex Media Server to the latest version available through the QNAP App Center, currently 1.43.3.10861, to protect against Plex2Shell attacks.
“The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected,” the vendor says.
User action required
QNAP says that users should treat their NAS devices and all personal content as compromised if they're running a vulnerable Plex server that is exposed on the public web.
The vendor warned that updating now will not remove any payloads the attackers have already installed on the device.
The recommended action is to check for the signs of compromise shared in the security bulletin, perform a clean reinstall of the OS (QTS or QuTS hero), and then reset Plex and NAS credentials.
Users who do not need to access Plex remotely should disable the related features and stop forwarding port 32400. Those who need remote access are advised to connect via VPN.
QNAP has released a detailed step-by-step remediation guide on how to do the above.
The company also offers to investigate logs from suspected compromises, which users can submit via QNAP’s technical support portal.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.