QNAP confirms NAS compromises via Plex2Shell exploit chain in Plex Media Server
QNAP has confirmed receiving multiple reports of NAS devices compromised through the Plex2Shell vulnerability chain in Plex Media Server, and its technical support is assisting affected customers. Plex2Shell is a chain of four flaws tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, reported to Plex by researcher Zach Main on 27 July; exploitation began shortly after full technical details became public on 16 October. CISA added all four to its Known Exploited Vulnerabilities catalog on 20 October 2026 with a three-day remediation deadline for federal agencies, pointing to Plex 1.43.3.10861 or later. QNAP PSIRT states the vulnerabilities exist only in Plex Media Server and that QTS, QuTS hero and other QNAP operating systems are not themselves affected. The exposure is limited to NAS devices running a vulnerable Plex server reachable from the public internet, typically through forwarded port 32400, but QNAP says such devices and all personal content should be treated as compromised.
Entenda a falha
A vulnerabilidade
Plex2Shell is a chain of four flaws in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The articles do not describe each flaw individually, so their separate impact and severity are not known here. The prerequisite is that the Plex server is reachable remotely, typically through forwarded port 32400 or remote access features; the end result is compromise of the NAS, with attackers installing payloads. Fixed in Plex Media Server 1.43.3.10861; QNAP says QTS, QuTS hero and other QNAP operating systems are not affected.
Como funciona
The articles do not describe how each flaw works inside Plex Media Server. What they say is that a vulnerable Plex server exposed to the internet, for example through port 32400 forwarding on a QNAP NAS, can be attacked remotely by chaining the four flaws, and that this ends in payloads installed on the device. The internal steps of the chain are not given.
Por que é vulnerável
The articles do not state the root cause of any of the four flaws. They only say the weaknesses are in Plex Media Server itself and not in QTS or QuTS hero, and that version 1.43.3.10861 or later fixes them. What the fix changes in the code is not described.
Como foi descoberta
Security researcher Zach Main discovered the flaws and reported them to Plex on 27 July. The full technical details became public on 16 October, and exploitation started shortly afterwards. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a three-day deadline for federal agencies to move to Plex 1.43.3.10861 or later. QNAP then confirmed reports of compromised NAS devices and is assisting affected users.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 15:18.
Detalhes técnicos
The article does not describe the individual flaws of the chain beyond their CVE identifiers, nor does it publish indicators of compromise; QNAP refers users to the signs of compromise listed in its own security bulletin. Attacks follow public disclosure of the technical details rather than a novel zero-day, and remote reachability of Plex (port 32400 forwarding or remote access features) is the prerequisite.
Remediação
Update Plex Media Server through the QNAP App Center to the current 1.43.3.10861. QNAP warns that patching does not remove payloads already installed: affected users should check for the indicators in the bulletin, perform a clean reinstall of QTS or QuTS hero, then reset Plex and NAS credentials. Users without a need for remote Plex access should disable the related features and stop forwarding port 32400; those who need it should use a VPN. QNAP published a step-by-step remediation guide and offers log analysis for suspected compromises via its technical support portal.
Linha do tempo
-
QNAP confirms NAS compromises via Plex2Shell exploit chain in Plex Media Server
ler a análise desta fonte ocultar
QNAP has confirmed receiving multiple reports of NAS devices compromised through the Plex2Shell vulnerability chain in Plex Media Server, and its technical support is assisting affected customers. Plex2Shell is a chain of four flaws tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, reported to Plex by researcher Zach Main on 27 July; exploitation began shortly after full technical details became public on 16 October. CISA added all four to its Known Exploited Vulnerabilities catalog on 20 October 2026 with a three-day remediation deadline for federal agencies, pointing to Plex 1.43.3.10861 or later. QNAP PSIRT states the vulnerabilities exist only in Plex Media Server and that QTS, QuTS hero and other QNAP operating systems are not themselves affected. The exposure is limited to NAS devices running a vulnerable Plex server reachable from the public internet, typically through forwarded port 32400, but QNAP says such devices and all personal content should be treated as compromised.
Technical Details
The article does not describe the individual flaws of the chain beyond their CVE identifiers, nor does it publish indicators of compromise; QNAP refers users to the signs of compromise listed in its own security bulletin. Attacks follow public disclosure of the technical details rather than a novel zero-day, and remote reachability of Plex (port 32400 forwarding or remote access features) is the prerequisite.
Remediation
Update Plex Media Server through the QNAP App Center to the current 1.43.3.10861. QNAP warns that patching does not remove payloads already installed: affected users should check for the indicators in the bulletin, perform a clean reinstall of QTS or QuTS hero, then reset Plex and NAS credentials. Users without a need for remote Plex access should disable the related features and stop forwarding port 32400; those who need it should use a VPN. QNAP published a step-by-step remediation guide and offers log analysis for suspected compromises via its technical support portal.