QNAP Says Hackers Are Breaching NAS Devices Through Plex2Shell Attack Chain

QNAP says attackers are compromising its NAS devices using a chain of Plex Media Server flaws known as Plex2Shell. The company received reports of suspected compromises, is helping affected users, and issued an advisory on November 6.

Plex2Shell combines four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. They exist only in Plex Media Server; QNAP's QTS, QuTS hero and other operating systems are not affected.

Researcher Zach Main reported the flaws to Plex on July 27. Full technical details became public on October 16 and exploitation began soon after. On October 20, CISA added all four CVEs to its Known Exploited Vulnerabilities catalog and told federal agencies to upgrade within three days.

Plex Media Server versions before 1.43.3.10861 are vulnerable. Users should update to 1.43.3.10861 or later through the QNAP App Center.

QNAP warns that updating does not remove payloads attackers may already have installed. Anyone who ran a vulnerable, internet-exposed server should treat the NAS and its data as compromised, check for signs of intrusion using QNAP's bulletin, reinstall the operating system cleanly, and reset Plex and NAS credentials.

Users who do not need remote Plex access should disable it and stop forwarding port 32400; those who do should use a VPN. Logs from suspected compromises can be submitted to QNAP technical support, and QNAP has published step-by-step remediation guidance in its FAQ.

Source: BleepingComputer

Raon Community wrote this article from the facts reported in the original. The original belongs to its author; see the source for full details.