Threat actors are exploiting Plex2Shell to hack into Plex Media Server applications on QNAP NAS devices, Taiwanese storage and networking solutions provider QNAP warns.
Plex2Shell is a chain of four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) in Plex Media Server that was patched this summer.
Widespread exploitation of the four-flaw chain started in mid-October, after technical details and proof-of-concept (PoC) code were published.
Successful exploitation of Plex2Shell does not require valid credentials and could allow attackers to execute arbitrary code on exposed servers, with the privileges of the Plex service.
Plex Media Server is available as a third-party application to QNAP NAS users, through the official App Center.
“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities,” the Taiwanese firm warned on Friday.
“The QNAP Technical Support team is assisting affected users and has confirmed that no data loss has occurred. The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected,” it added.
QNAP NAS users are advised to update to Plex Media Server version 1.43.3 or later as soon as possible.
Devices accessible from the internet should be considered potentially compromised and Plex should be reinstalled, QNAP says, adding that the passwords for both Plex and the NAS should be immediately rotated.
“If you do not need remote access to Plex, disable Plex Remote Access and do not forward port 32400. If you do need remote access, use a VPN instead. Also make sure QTS or QuTS hero and all installed apps are up to date,” QNAP says.
The company has published a step-by-step remediation guide to help users identify and respond to potential compromises.
Related: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Related: Critical Node-RED Flaw Exploited in Attacks
Related: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
