Plex2Shell Vulnerabilities Exploited Against QNAP NAS Users

Summary

QNAP reports exploitation of Plex2Shell, a four-flaw chain in Plex Media Server that can enable unauthenticated code execution. QNAP says some users’ servers appear compromised, reports no data loss, and advises updating and checking exposed devices.

Key points

Plex2Shell comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 in Plex Media Server; the flaws were patched this summer.
Widespread exploitation reportedly began in mid-October after technical details and proof-of-concept code were published.
Exploitation does not require valid credentials and could allow arbitrary code execution with the Plex service’s privileges.
QNAP says it received reports that some Plex Media Server installations on its NAS devices appeared compromised. It reports no data loss and says QTS, QuTS hero and other QNAP operating systems are not affected by the vulnerabilities.
QNAP advises updating Plex Media Server to version 1.43.3 or later. For internet-accessible devices, it recommends considering them potentially compromised, reinstalling Plex and rotating Plex and NAS passwords.
QNAP also advises disabling Plex Remote Access and not forwarding port 32400 when remote access is unnecessary; if remote access is needed, it recommends using a VPN and keeping systems and apps updated.

Article Details

Vulnerability Types: Arbitrary code execution
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Disable Plex Remote Access and do not forward port 32400 if remote access is not needed.
Use a VPN for remote access to Plex.
For internet-accessible devices considered potentially compromised, reinstall Plex and rotate both Plex and NAS passwords.