QNAP NAS: Plex2Shell, four CVEs, assume compromise
QNAP says customers' NAS devices are being compromised through Plex2Shell, a four-bug chain in Plex Media Server now on CISA's catalog. Update Plex to 1.43.3.10861, and rebuild any box that was exposed on an older build.
By ZeroDay Times Desk2 min read
![Editorial thumbnail for “QNAP NAS: Plex2Shell, four CVEs, assume compromise”, shield graphic on a crimson and charcoal banner-flow card, [ ZERO-DAY ] badge, and the ZeroDay Times mark.](/images/articles/qnap-plex2shell-four-cves-assume-compromise.svg)
QNAP told customers on November 6, 2026, that Plex Media Server on some of its network-attached storage units looks compromised. The name on the incidents is Plex2Shell. Support is already working those cases. A closet NAS that holds backups and a media library is the same machine as the one in the reports.
The chain is four Plex bugs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Researcher Zach Main reported them to Plex on July 27. Full public detail arrived on October 16, and exploitation followed that publication. On October 20, CISA put all four on the Known Exploited Vulnerabilities catalog and gave federal civilian agencies three days to reach Plex 1.43.3.10861 or later. That build is the one QNAP is serving in the App Center.
QNAP’s product security team places the bugs in Plex Media Server. QTS, QuTS hero, and the rest of the QNAP operating-system line host that app and the files it can see. Once Plex on an internet-facing unit is in attacker hands, the shares on that box go with it.
Update the app, then decide if the box is already lost
Move Plex to 1.43.3.10861 or any newer App Center build QNAP ships for this chain. Read the version back from the device. A banner that still shows an older package is still in the campaign.
The App Center package closes the bugs on a unit that was never reachable on the old build. Where a vulnerable Plex server sat on the public web, QNAP’s instruction is to treat the NAS and the personal content on it as compromised. The update leaves anything already placed on the device. The remediation QNAP wants from there is a clean reinstall of QTS or QuTS hero, a reset of Plex, and new credentials for both Plex and the NAS.
Use the compromise indicators in QNAP’s bulletin before anyone marks the ticket done. The company posted a remediation guide and will review logs sent through its technical support portal. An App Center click plus the old admin password finishes the easy half.
Remote streaming is how these boxes meet the internet
Plex is the reason a lot of QNAP units accept connections from outside the house or the office. If nobody needs playback from the road, turn those remote features off and stop forwarding TCP port 32400. If remote playback has to stay, put it on a VPN the organization already operates.
Count every QNAP with Plex installed, including the unit that “only does backups.” Confirm 1.43.3.10861 or newer, then choose reinstall from the exposure, not from optimism. Federal teams drew a three-day line on October 20. Everyone else is on the clock set by the reports QNAP is already taking.
This briefing relies on public reporting by BleepingComputer and on QNAP’s advisory.
Corrections and tips:[email protected]