QNAP urges Plex update after NAS compromise reports

By Daniel Okafor

Four Plex Media Server CVEs are under active exploitation on QNAP NAS devices, according to QNAP. QNAP said it had received multiple reports of suspected compromises. The vendor disclosed no victim count, device total, affected geography or financial loss.

What does the breach involve?

The vulnerability chain, called Plex2Shell, contains four flaws:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656

Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16.

CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026. It urged federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, assigning the issues maximum priority.

QNAP stated: “QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users.”

Which QNAP systems are affected?

QNAP's Product Security Incident Response Team confirmed the scope in a second statement: “The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected.”

That finding limits the flaws to the installed Plex application. It does not exonerate a NAS whose Plex service or stored content has already been compromised.

QNAP NAS devices are specialized computers with built-in storage for storing, accessing and sharing files across networks. Users typically employ them for computer backups and media storage.

QNAP App Center adds applications to those systems. Plex Media Server streams movies, television shows and music directly from the NAS drives.

What must exposed users do?

QNAP says anyone running a vulnerable Plex server exposed to the public web should treat the entire NAS device and all personal content as compromised. Updating now will not remove payloads that attackers have already installed.

The vendor recommends this sequence:

• Review the signs of compromise listed in QNAP's security bulletin.
• Perform a clean reinstallation of the NAS operating system, either QTS or QuTS hero.
• Reset both Plex and NAS credentials.

QNAP has also published a detailed, step-by-step remediation guide covering that process.

Remote-access choices differ by requirement:

• Users without a remote-access requirement should disable the related Plex features and stop forwarding port 32400.
• Users requiring remote access should connect through a VPN.

QNAP offers to investigate logs from suspected compromises. Users can submit those logs through QNAP's technical support portal.

How urgent is the update?

QNAP recommends updating Plex Media Server through QNAP App Center to 1.43.3.10861, the latest available version, to protect against Plex2Shell attacks.

CISA's three-day deadline applies specifically to federal agencies. QNAP's remediation warning applies to every user with a vulnerable, publicly exposed server.

Neither QNAP nor CISA disclosed remediation costs, affected-organization counts, compromised-device totals, geographic reach, stolen-data volumes, financial losses or attack duration within the published warning. The multiple compromise reports cannot support a national or global victim total.

An update alone is insufficient for potentially compromised systems. Organizations retaining remote access should use a VPN. Those without that requirement should disable the related features and remove port 32400 forwarding.

QNAP's guidance therefore extends beyond patching. It recommends exposure review, a clean OS reinstallation, credential resets and a remote-access decision.