EN PT-BR
← Voltar ao feed
critical defense media

Plex2Shell exploit chain in Plex Media Server (CVE-2026-96652/54/55/56) used in the wild to compromise QNAP NAS devices; CISA KEV-listed

5 fonte(s) · 5 atualização(ões) · publicado 06/11/2026 14:04 · coletado há 11 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 10/11/2026 00:07; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityaffairs.com ↗ securityweek.com ↗ securityonline.info ↗ bleepingcomputer.com ↗

QNAP warned on November 6, 2026 that attackers are exploiting Plex2Shell against Plex Media Server on its NAS devices, and that it had received multiple reports of suspected compromises (bleepingcomputer.com, securityonline.info). Plex2Shell chains four flaws, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, which allow code execution as the Plex service account (securityweek.com, securityaffairs.com). Zach Main published technical details and PoC code on October 16, 2026. Within a day, researchers saw exploitation against a honeypot that dropped cryptocurrency-mining malware and proxy software (securityaffairs.com). CISA added the four flaws to its KEV catalog on October 20, 2026, with an October 23 deadline for federal agencies (securityaffairs.com). QNAP's PSIRT says only Plex Media Server is affected, not QTS, QuTS hero or other QNAP operating systems, and its support team found no data loss (securityweek.com). Servers on 1.43.2 or earlier that were reachable from the internet should be treated as potentially compromised (securityonline.info, securityaffairs.com). Synology also published a DSM advisory for the same flaws on November 8, 2026 (cert.cyber.gouv.fr).

Entenda a falha

A vulnerabilidade

Plex2Shell chains four Plex Media Server flaws, exploited in the wild and in CISA KEV, that give code execution as the Plex service user. CVE-2026-96656 (CVSS 7.2) lets an admin write a file that Plex later loads as a library. CVE-2026-96654 (6.5) needs no privileges and lets URL values call other plugins' functions. CVE-2026-96652 and CVE-2026-96655 (4.3 each) are SSRF flaws that need an authenticated user or any X-Plex-Token. Chained on an internet-exposed server (Remote Access, port 32400 or UPnP), they allow unauthenticated code execution. Fixed in Plex 1.43.3 (1.43.3.10861) on QNAP and 1.43.5.11079 on DSM; 1.43.2 and earlier are affected. Separately, CVE-2026-111497 (9.8) is a Brotli decoder buffer overflow (1.0.3 to 1.2.0) in Synology Chat Client, fixed in 1.2.5-0240. It is not part of Plex2Shell.

Como funciona

An attacker reaches the exposed Plex service over the network. The SSRF and plugin-call flaws let web requests steer the server's behavior. The chain then abuses a transcoding setting (the TranscoderH264Options preference) to write a file into the codec directory. A second transcode request makes Plex re-enumerate that directory and load every shared object it finds. The loader checks no name, execute permission, signature or exported symbols, so the planted library's ELF constructor runs on load, before symbol resolution, as the plex user (uid 1000). In the Brotli case, the Chat Client passes a compressed stream to the decoder, which can overflow a buffer.

Por que é vulnerável

The root cause is missing validation at several points. The transcoder loader runs any shared object in the codec directory without checking name, permissions, signature or symbols (CWE-73). 'searchOne' does not neutralize URL values (CWE-84), and '/player/timeline' accepts any X-Plex-Token value and requests attacker-chosen addresses (CWE-918). The transcode endpoint also fetches arbitrary addresses. Each flaw is limited alone, but together they give code execution. The Brotli bug is classed CWE-252, and the fixed Brotli releases correct it. The articles do not explain why these went unnoticed.

Onde está

The articles name the TranscoderH264Options preference, the transcoder library loader and codec directory (dlopen of shared objects), 'searchOne', '/player/timeline', the transcode endpoint and the Brotli decoder in Chat Client; no file, function or commit is given.

Como foi descoberta

Researcher Zach Main found the Plex flaws and reported them to Plex on July 27, 2026. Plex acknowledged the report on August 4, paid a bug bounty and released fixes in September, before the exploit was public (securityweek says only 'this summer'). Main published technical details and PoC code on October 16, and within a day researchers saw exploitation against a honeypot. CISA added the four CVEs to KEV on October 20, and QNAP warned of compromises on November 6. Synology published its DSM advisory on November 8. Synology's advisories state no exploitation, which conflicts with the later QNAP, CISA and honeypot evidence. The articles do not say who found the Brotli flaw.

PoC pública

Zach Main published PoC code and a technical write-up (Plex2Shell) on October 16, 2026. It demonstrates the full chain from web requests to code execution as the Plex service user on an exposed server. It is a working exploit: within a day attackers used it against a honeypot to drop cryptocurrency miners and proxy software, and QNAP reports compromised NAS devices. Patching is urgent. Updating does not remove payloads already installed, so exposed servers on 1.43.2 or earlier should be treated as compromised.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 00:22.

Detalhes técnicos

  • Exposure condition: the Plex service must be reachable from the internet, via Plex Remote Access, a forwarded port 32400 or UPnP. NAS units without that exposure face lower immediate risk (securityweek.com, securityaffairs.com).
  • Mechanism: the transcoder library loader does not check a library's name, execute permission, signature or exported symbols. A planted shared object runs its ELF constructor on load, before symbol resolution. A second transcode request makes Plex re-enumerate the codec directory, loading the planted library and running code as the plex user (uid 1000). A transcoding-related setting lets the attacker steer the load (securityaffairs.com).
  • Synology's per-CVE details (synology.com, via cert.cyber.gouv.fr):
    • CVE-2026-96656 (CVSS 3.1 7.2, CWE-73): an admin can write files that are executed on load. The TranscoderH264Options preference is passed to x264, and all .so files are run at startup without signature or symbol checks.
    • CVE-2026-96654 (6.5, CWE-84): unneutralized URL values in 'searchOne' let an attacker call other plugins' functions with attacker-supplied parameters, with no privileges required.
    • CVE-2026-96652 (4.3, CWE-918): SSRF through '/player/timeline', reachable with any X-Plex-Token value.
    • CVE-2026-96655 (4.3): an authenticated user can make the server request arbitrary internal or external addresses through the transcode endpoint.
  • Unrelated Synology flaw: the same CERT-FR notice covers CVE-2026-111497 (CVSS 9.8, CWE-252), a buffer overflow in the Google Brotli decoder (versions 1.0.3 to 1.2.0). It affects the Synology Chat Client (Synology-SA-26:15), which Synology rates Moderate, and it is not part of Plex2Shell (cert.cyber.gouv.fr).
  • Disclosure and fix: Plex was notified on July 27, 2026, acknowledged the report on August 4 and paid a bug bounty. It released fixes in September, before the exploit code became public (securityaffairs.com).

Remediação

  • QNAP: update Plex Media Server to 1.43.3 or later through App Center, then confirm in Plex Web (Settings, General) that the version is 1.43.3.10861 or later (securityaffairs.com, securityweek.com).
  • Treat internet-exposed devices on 1.43.2 or earlier as potentially compromised: reinstall Plex and rotate the Plex and NAS passwords (securityweek.com, securityonline.info).
  • Disable Plex Remote Access and do not forward port 32400 unless needed. If remote access is needed, use a VPN. Keep QTS or QuTS hero and all apps up to date (securityweek.com).
  • QNAP has published a step-by-step guide for identifying and responding to compromise (securityweek.com).
  • Synology DSM: upgrade Plex Media Server for DSM 7.3 and 7.4 to 1.43.5.11079-720011079 or later, and DSM 7.2.1 and 7.2.2 to 1.43.5.11079-700011079 or later. Synology lists no mitigation. Upgrade the Chat Client to 1.2.5-0240 or later. Other Brotli builds in the 1.0.3 to 1.2.0 range should move to 1.0.10, 1.1.1 or 1.2.1 (cert.cyber.gouv.fr).

Relatos divergentes

  • Authentication: securityweek.com and securityaffairs.com say the chain needs no valid credentials. Synology's per-CVE ratings say three of the four CVEs need an authenticated account and the top-scored one needs admin, with only CVE-2026-96654 needing no privileges (cert.cyber.gouv.fr). The sources are consistent if the flaws are chained, since the exposure conditions then allow unauthenticated code execution. No source explains this reconciliation explicitly.
  • Exploitation status: Synology's advisories state no exploitation in the wild (cert.cyber.gouv.fr). QNAP, CISA's KEV listing and honeypot observations confirm exploitation (securityaffairs.com, securityweek.com). The exploitation reports are more recent and better evidenced.
  • Fix timing: securityweek.com says Plex patched the flaws "this summer". securityaffairs.com gives September 2026, based on the disclosure timeline, and is the more precise source.
  • Fixed version: QNAP's guidance gives 1.43.3 (build 1.43.3.10861) as the minimum (securityonline.info, securityaffairs.com). Synology's DSM packages require 1.43.5.11079 (cert.cyber.gouv.fr). These are different platforms with different package builds, so follow the vendor guidance for your own platform.
  • Dates: securityonline.info dates QNAP's notice to November 6, 2026, which matches bleepingcomputer.com. CERT-FR dates Synology-SA-26:15 to November 9, 2026. Synology shows initial publication on October 29 and a last update on November 9, so November 9 is the update, not the first release (cert.cyber.gouv.fr).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01

    Synology patches Plex Media Server for DSM and Chat Client flaws, including Brotli-based CVE-2026-111497

    ler a análise desta fonte

    Synology published two advisories covering DSM packages: Synology-SA-26:17 for Plex Media Server for DSM (named Plex2Shell, dated 8 November 2026 on synology.com) and Synology-SA-26:15 for the Synology Chat Client. The Plex advisory lists four CVEs, all rated Important by Synology, with CVSS 3.1 base scores from 4.3 to 7.2; three of them need an authenticated account, the highest-scored one (CVE-2026-96656, 7.2) needs an admin account, and only CVE-2026-96654 (6.5) needs no privileges. The Chat Client flaw, CVE-2026-111497, is a buffer overflow in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0, which carries a 9.8 CVSS score at CVE level, yet Synology rates the Chat Client product as Moderate. Neither advisory states exploitation in the wild, and Synology lists no mitigation, so applying the fixed versions is the only remedy. Criticity is high: the unauthenticated memory-corruption flaw is serious, but the product-level severity, the absence of any stated exploitation and the admin requirement for the top Plex flaw limit the immediate urgency.

    Technical Details

    • CVE-2026-96656 (CVSS 3.1 7.2, CWE-73): an admin user can write files that are executed on load, because the TranscoderH264Options preference is passed to x264 and all .so files are run at startup without signature or symbol checks (synology.com).
    • CVE-2026-96654 (CVSS 3.1 6.5, CWE-84): unneutralized URL values in 'searchOne' let an attacker call other plugins' functions with attacker-supplied parameters, with no privileges required (synology.com).
    • CVE-2026-96652 (CVSS 3.1 4.3, CWE-918): SSRF through '/player/timeline', reachable with any X-Plex-Token value (synology.com).
    • CVE-2026-96655 (CVSS 3.1 4.3): an authenticated user can make the server request arbitrary internal or external addresses through the transcode endpoint (synology.com).
    • CVE-2026-111497 (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, CWE-252): a buffer overflow in the Brotli decoder in Google Brotli 1.0.3 to 1.2.0 lets a remote unauthenticated attacker corrupt decoder state, disclose memory, cause denial of service or potentially execute code with a crafted compressed stream (synology.com).

    Remediation

    • Upgrade Plex Media Server for DSM 7.3 and 7.4 to 1.43.5.11079-720011079 or later, and DSM 7.2.1 and 7.2.2 to 1.43.5.11079-700011079 or later (synology.com).
    • Upgrade the Synology Chat Client to 1.2.5-0240 or later (synology.com).
    • For any other Brotli library or binary in the 1.0.3 to 1.2.0 range, move to 1.0.10, 1.1.1 or 1.2.1 (synology.com).

    Conflicting Reports

    • The CERT-FR notice dates Synology-SA-26:15 to 9 November 2026 (cert.cyber.gouv.fr). The Synology advisory shows an initial publication on 29 October 2026 and a last update on 9 November 2026, so the later date is the update, not the first release (synology.com).
  2. securityaffairs.com ↗ · pub. 09/11/2026 11:40 · coletado 09/11 12:00

    Plex2Shell chain exploited in the wild to compromise QNAP NAS devices running Plex Media Server

    What is new: CISA added the four flaws to its KEV catalog on October 20, 2026, with an October 23 deadline (securityaffairs.com). Researchers observed exploitation against a honeypot within a day of the October 16 PoC, with cryptomining and proxy payloads (securityaffairs.com). QNAP gives exact version checks (1.43.3.10861 or later) and says devices exposed on 1.43.2 or earlier should be treated as potentially compromised (securityaffairs.com). The fix timing is corrected to September 2026 rather than 'this summer'.

    ler a análise desta fonte

    What is new: CISA added the four flaws to its KEV catalog on October 20, 2026, with an October 23 deadline (securityaffairs.com). Researchers observed exploitation against a honeypot within a day of the October 16 PoC, with cryptomining and proxy payloads (securityaffairs.com). QNAP gives exact version checks (1.43.3.10861 or later) and says devices exposed on 1.43.2 or earlier should be treated as potentially compromised (securityaffairs.com). The fix timing is corrected to September 2026 rather than 'this summer'.

    QNAP urges users to update Plex Media Server after reports that attackers compromised NAS devices through the Plex2Shell chain: four flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that, per the article, allow code execution without valid credentials when the required conditions are met. Zach Main published the technical details and PoC code on October 16, 2026, and within a day researchers saw the exploit used against an internet-facing honeypot to drop cryptocurrency-mining malware and proxy software. CISA put the flaws in its Known Exploited Vulnerabilities catalog on October 20, 2026, with an October 23 deadline for federal agencies. QNAP's PSIRT confirmed the flaws are confined to Plex Media Server, leaving QTS, QuTS hero and other QNAP operating systems unaffected. Criticity is critical because exploitation is confirmed and no authentication is needed, but the risk depends on exposure: the Plex service must be reachable from the internet, through Remote Access, a forwarded port 32400 or UPnP, so NAS units without such exposure face lower immediate risk.

    Technical Details

    The chain relies on how the Plex service loads transcoder libraries. According to the article's account of the analysis, the loader does not check the library's name, execute permission, signature or exported symbols, so a planted shared object runs its ELF constructor as soon as it is loaded, before any symbol resolution (securityaffairs.com). A second transcode request makes Plex re-enumerate the codec directory, which loads the planted library and runs its code as the plex user, uid 1000 (securityaffairs.com). A transcoding-related setting is what lets the attacker steer that load, and the result is code execution under the service account without a prior interactive login (securityaffairs.com). The chain needs no valid credentials, provided the exposure conditions hold (securityaffairs.com; securityweek.com).

    Fix Details

    Plex was notified of the vulnerabilities on July 27, 2026, acknowledged the report on August 4 and awarded a bug bounty; it released fixes in September, before the exploit code became public (securityaffairs.com). QNAP's advice is to update Plex Media Server to 1.43.3 or later through App Center, then confirm in Plex Web under Settings and General that the version is 1.43.3.10861 or later (securityaffairs.com). The fix commit and pull request were not retrieved in this analysis, and Plex's release notes were not opened, so the fixed build for each branch is not established beyond the 1.43.3 line.

    Remediation

    • Update Plex Media Server to 1.43.3 or later through the QNAP App Center, then confirm version 1.43.3.10861 or later in Plex Web (securityaffairs.com).
    • Treat any NAS running Plex 1.43.2 or earlier that was reachable from the internet as potentially compromised, especially if Plex Remote Access was enabled, port 32400 was forwarded, or UPnP or router rules opened it (securityaffairs.com).
    • Updating does not remove anything an attacker may have installed: follow QNAP's FAQ for a clean reinstall, check for signs of compromise, and reset both Plex and NAS credentials (securityaffairs.com).
    • Disable Plex Remote Access if it is not needed, avoid forwarding port 32400, and use a VPN for remote access (securityaffairs.com).
    • Keep QTS or QuTS hero and all installed apps up to date (securityaffairs.com).
    • QNAP has published a step-by-step remediation guide (securityweek.com).
  3. securityweek.com ↗ · pub. 09/11/2026 10:13 · coletado 09/11 11:00

    Plex2Shell chain exploited against Plex Media Server on QNAP NAS; QNAP urges update to 1.43.3 and says exposed devices may be compromised

    SecurityWeek adds QNAP's statement that no data loss was confirmed and that only Plex Media Server is affected, not QTS or QuTS hero. It gives the minimum fixed version (1.43.3), says the flaws were patched in summer and exploited widely from mid-October after PoC publication, and lists QNAP's guidance: treat exposed devices as compromised, reinstall Plex, rotate passwords, disable remote access and port 32400 forwarding, and use a VPN.

    ler a análise desta fonte

    SecurityWeek adds QNAP's statement that no data loss was confirmed and that only Plex Media Server is affected, not QTS or QuTS hero. It gives the minimum fixed version (1.43.3), says the flaws were patched in summer and exploited widely from mid-October after PoC publication, and lists QNAP's guidance: treat exposed devices as compromised, reinstall Plex, rotate passwords, disable remote access and port 32400 forwarding, and use a VPN.

    QNAP warns that threat actors are exploiting Plex2Shell against Plex Media Server running on its NAS devices. Plex2Shell is a chain of four flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that Plex patched this summer. Widespread exploitation began in mid-October, after technical details and PoC code were published. QNAP says some users reported compromised Plex servers. Its support team found no data loss. QNAP PSIRT says the flaws exist only in Plex Media Server, so QTS, QuTS hero and other QNAP operating systems are not affected (securityweek.com).

    Technical Details

    The chain needs no valid credentials. It allows arbitrary code execution with the privileges of the Plex service. Internet-exposed servers are at risk, particularly those with Plex Remote Access enabled or port 32400 forwarded (securityweek.com). The article gives no CVSS scores.

    Remediation

    • Update Plex Media Server to 1.43.3 or later.
    • Treat internet-accessible devices as potentially compromised and reinstall Plex.
    • Rotate the Plex and NAS passwords immediately.
    • Disable Plex Remote Access and do not forward port 32400 if remote access is not needed. If it is needed, use a VPN.
    • Keep QTS or QuTS hero and all installed apps up to date.
    • QNAP has published a step-by-step guide for identifying and responding to compromise (securityweek.com).
  4. securityonline.info ↗ · pub. 09/11/2026 07:14 · coletado 09/11 08:00

    QNAP Warns NAS Users as Exploited Plex2Shell Vulnerabilities Hit Plex Media Server

    ler a análise desta fonte

    On November 6, 2026, QNAP issued a security notice about the Plex2Shell vulnerabilities in Plex Media Server, a third-party app offered for QNAP NAS devices. Attackers are already abusing the flaws. In fact, QNAP says some customers’ Plex installs appear to have been compromised. The company urges every Plex user on a QNAP NAS to update now.

    Four chained bugs in Plex Media Server 1.43.2 and earlier let an unauthenticated attacker run code on the server. Plex 1.43.3 (build 1.43.3.10861 or later) fixes them and is live in the QNAP App Center. If Plex was reachable from the internet, QNAP says to treat the NAS as potentially compromised.

  5. bleepingcomputer.com ↗ · pub. 06/11/2026 14:04 · coletado 06/11 15:00 primeiro registro

    QNAP says hackers breaching NAS devices in Plex2Shell attacks

    ler a análise desta fonte

    QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

    The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices.