QNAP has warned customers to update Plex Media Server on network-attached storage devices after security companies observed active exploitation of a chain of four vulnerabilities known as Plex2Shell. TechRadar reported on November 9 that attackers were using the flaws against internet-exposed NAS systems. QNAP urged users to install the latest version of Plex Media Server and inspect devices that may have been exposed while running older software. The advisory matters because a NAS can hold backups, personal media, business documents and shared files, making a successful compromise more serious than a problem limited to a streaming application.
Four Plex flaws combine into a remote takeover path
The vulnerabilities affect Plex Media Server versions 1.43.2 and older. The four identifiers are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. TechRadar reported that the flaws are individually serious and can be chained to let an unauthenticated attacker execute arbitrary code remotely with high privileges. In practical terms, an attacker does not need a valid account on the exposed service to begin the exploit chain. If the chain succeeds, the attacker may be able to take control of the NAS and access information stored on it. QNAP’s security notice identifies the affected versions and the recommended recovery steps.
Plex released a fix in September in Media Server version 1.43.3, build 1.43.3.10861. QNAP says the corrected version can be installed through its App Center. The company also clarified that the vulnerabilities affect Plex Media Server rather than the QTS or QuTS operating systems themselves. That distinction helps administrators identify the affected component, but it does not mean the underlying NAS is safe if the vulnerable application was exposed. A compromised application can provide a route to files, credentials or other services on the device even when the NAS operating system is not itself vulnerable.
Exposed systems may need more than a routine software update
Attackers have reportedly used compromised systems to install proxy software and cryptocurrency miners. A residential proxy can route criminal traffic through a legitimate internet connection, making it harder to identify the real origin of an attack. A NAS device with a stable broadband connection and large storage capacity can be attractive for this purpose. Cryptocurrency mining may be less profitable on a typical storage device than on a GPU server, but the malware can still consume resources and signal that an attacker has obtained control. A compromised NAS may also be used as a stepping stone to reach other devices on the same network.
CISA added all four vulnerabilities to its Known Exploited Vulnerabilities catalogue on October 20. Federal civilian agencies were given a short deadline to apply the fix or stop using Plex. The presence of the vulnerabilities in the catalogue reflects confirmed exploitation and raises the urgency for organisations that use Plex on internet-accessible storage. TechRadar cited BitSight figures indicating tens of thousands of QNAP NAS devices are reachable from the internet, although that does not mean all are vulnerable or running Plex Media Server. The actual exposed population depends on software version, network configuration and whether remote access is allowd.
QNAP’s guidance is more serious for devices that were reachable from the internet while running an affected version. Plex has said that simply updating may not be enough for systems that were exposed before patching; administrators should treat them as potentially compromised, perform a clean reinstall, check for signs of intrusion and reset credentials. Organisations should also review remote-access rules, remove unnecessary port forwarding and ensure backups are isolated from the NAS account used for daily access. The incident is a reminder that storage appliances are servers and need the same patching, monitoring and recovery discipline as other internet-facing systems.
Administrators should verify the version from the Plex application interface rather than assume that updating the NAS firmware also updates Plex. They should review access logs, unexpected processes, new accounts and outbound connections, then compare the device’s state with a known-good backup. If a business cannot determine whether the device was compromised, rebuilding it from trusted software and rotating credentials is safer than returning the same installation to service. Remote access should be re-allowd only after the device has been checked and patched.