Skip to content
Hacker Posts

QNAP warns NAS users to treat Plex2Shell boxes as compromised

QNAP says Plex Media Server on some NAS devices appears compromised via the Plex2Shell chain (CVE-2026-96652 to -96656). Update to 1.43.3.10861 — but updating alone won't evict attackers.

Published 3 min read
advisoryqnapplexrce

QNAP issued a security notice on November 6 telling NAS owners that Plex Media Server installed from its App Center is being exploited through the Plex2Shell chain, and that some users' servers "appear to have been compromised." The four bugs — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — chain to unauthenticated code execution. The fix is Plex Media Server 1.43.3.10861 or later, available via App Center. Update now.

What's affected

QNAP's PSIRT confirms the flaws exist only in Plex Media Server, not in QTS, QuTS hero, or other QNAP operating systems. Affected: Plex Media Server 1.43.2 and earlier. The exposure is any NAS that installed Plex through the App Center and, in particular, any box that exposed it to the internet.

We covered the underlying chain when exploitation began: the researcher's write-up and a honeypot catching in-the-wild hits the day after the PoC dropped, and the four-bug SSRF-to-RCE mechanics. What's new is QNAP confirming compromised NAS devices and issuing its own remediation path. CISA added all four CVEs to the KEV catalog on October 20, with a three-day federal deadline.

Exploitation status

QNAP says it has received reports of compromised Plex instances on NAS devices and that Technical Support is assisting affected users. It does not claim widespread compromise. The key operational point from QNAP: "updating alone will not remove anything an attacker may have installed." Patch closes the door; it does not clean the house.

Action checklist

  1. Update Plex Media Server to 1.43.3.10861 or later via App Center → My Apps. Confirm the running version under Plex Web → Settings → General.
  2. Assume compromise on any NAS that ran 1.43.2 or earlier while Plex was reachable from the internet.
  3. Clean reinstall and reset per QNAP's remediation FAQ: check for indicators of compromise, perform a clean reinstall of QTS/QuTS hero, and reset both Plex and NAS credentials.
  4. Cut exposure: disable Plex Remote Access and stop forwarding port 32400 unless you need it; if you do, reach the NAS over a VPN instead.

Context

This is the predictable second wave of a chain whose fix shipped months before most owners applied it. Appliance and NAS vendors inherit the exposure of every app in their store, and the gap between an upstream Plex patch and a QNAP user updating from App Center is exactly the window attackers worked. Treating the update as cleanup — rather than as a lock on an already-open door — is the mistake QNAP is trying to head off.

Related stories