QNAP Warns NAS Users as Exploited Plex2Shell Vulnerabilities Hit Plex Media Server
Do Son 
Image: QNAP
TL;DR
On November 6, 2026, QNAP issued a security notice about the Plex2Shell vulnerabilities in Plex Media Server, a third-party app offered for QNAP NAS devices. Attackers are already abusing the flaws. In fact, QNAP says some customers’ Plex installs appear to have been compromised. The company urges every Plex user on a QNAP NAS to update now.
Four chained bugs in Plex Media Server 1.43.2 and earlier let an unauthenticated attacker run code on the server. Plex 1.43.3 (build 1.43.3.10861 or later) fixes them and is live in the QNAP App Center. If Plex was reachable from the internet, QNAP says to treat the NAS as potentially compromised.
- Product: Plex Media Server
- Vulnerabilities: 4 flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)
- Highest severity: 8.6 (High · CVSSv4)
- Worst impact: arbitrary file write
- Status: 4 exploited; patches available
- Exploit Intel (PatchThis): 4 of 4 confirmed
- Action: Update to 1.43.3.10861 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status | PoC |
|---|---|---|---|---|---|
| CVE-2026-96656 | 8.6 | arbitrary file write | 1.43.3.10861 | Exploited | — |
| CVE-2026-96654 | 6.9 | URL injection | 1.43.3.10861 | Exploited | — |
| CVE-2026-96652 | 5.3 | SSRF | 1.43.3.10861 | Exploited | Available (Nuclei) |
| CVE-2026-96655 | 5.3 | arbitrary-host SSRF | 1.43.3.10861 | Exploited | Available (Nuclei) |
Why It Matters
This is not a theoretical risk. According to the QNAP notice, “Plex has confirmed that these vulnerabilities are being actively and widely exploited.” A public proof of concept appeared on October 16. Since then, unpatched servers facing the internet “have since been subject to widespread attacks.”
The attackers so far want computing power. QNAP notes that “compromised servers have been used to run cryptocurrency miners and proxy software.” Meanwhile, CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on October 20.
What QNAP has seen
Some users told QNAP their Plex Media Server “appears to have been compromised through these vulnerabilities.” Its support team is helping them and “has confirmed that no data loss has occurred.” Importantly, QNAP PSIRT says QTS, QuTS hero and other QNAP operating systems “are not themselves affected.”
How the Attack Works
On its own, each Plex2Shell flaw carries limited risk. However, QNAP explains that “chained together they allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the Plex Media Server process.” The CVE records describe the four links in the chain:
- CVE-2026-96652 (CVSS 4.3): a server-side request forgery (SSRF) bug that forces the server to send requests to an attacker’s address.
- CVE-2026-96654 (CVSS 6.5): a URL injection flaw that lets an attacker call other plugins’ functions with their own parameters.
- CVE-2026-96655 (CVSS 4.3): a second SSRF bug that reaches arbitrary internal or external addresses.
- CVE-2026-96656 (CVSS 7.2): an arbitrary file write through a transcoder setting. Plex then loads the planted library file at startup without checks.
Put together, the Plex2Shell vulnerabilities turn a simple web request into code running inside Plex.
Affected Versions
- Plex Media Server 1.43.2 and earlier, on any platform
- QNAP NAS devices with an affected Plex version installed
A NAS without Plex needs no action.
Patch and Mitigation
Update Plex first
Go to App Center, open My Apps and update Plex Media Server to 1.43.3. Then confirm the build is 1.43.3.10861 or later. QNAP adds that newer Plex releases will follow, but users should “not wait for them – update now.” The official QNAP Plex2Shell security notice has the full guidance. Plex also posted its own security update announcement for Plex Media Server.
Check exposed servers
Patching alone is not enough for exposed systems. As QNAP warns, “updating alone will not remove anything an attacker may have installed.” This applies if Remote Access was on, port 32400 was forwarded, or UPnP opened the port. In that case, QNAP’s Plex2Shell check and remediation FAQ asks users to do three things:
- Perform a clean reinstall, and do not reuse the old Codecs folder.
- Check for unknown Plex processes, odd library files in Codecs, traffic to proxystream.st, or high idle CPU use.
- Sign out all Plex devices, change the Plex password, and rotate NAS and stored service credentials.
Reduce exposure
Finally, turn off Plex Remote Access if you do not need it and stop forwarding port 32400. For remote viewing, use a VPN instead. Also keep QTS or QuTS hero and all apps current. Because these Plex2Shell vulnerabilities are under active attack, every unpatched, internet-facing server is at risk.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
