QNAP Reports Suspected NAS Compromises in Plex2Shell Attacks

Summary

QNAP reports multiple suspected NAS compromises involving four Plex Media Server flaws exploited after technical details became public. It urges users to update; exposed vulnerable devices should be treated as compromised, and updating alone will not remove payloads.

Key points

QNAP says it received multiple reports of suspected compromises involving Plex Media Server on customers’ NAS devices.
Plex2Shell comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Exploitation reportedly began shortly after full technical details became public on October 16, 2026; CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20.
QNAP advises updating Plex Media Server through its App Center to version 1.43.3.10861 or later.
QNAP says QTS, QuTS hero, and other QNAP operating systems are not themselves affected; the vulnerabilities are in Plex Media Server.
For vulnerable Plex servers exposed to the public web, QNAP advises treating the NAS and its contents as compromised. Updating alone will not remove installed payloads; its guidance includes checking for compromise, reinstalling the OS, and resetting credentials.
Users who do not need remote Plex access should disable related features and stop forwarding port 32400; users who need remote access are advised to use a VPN.

Article Details

Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: If remote Plex access is not needed, disable the related features and stop forwarding port 32400.
For remote access, connect via VPN.