QNAP has issued a formal security advisory warning users of its network-attached storage (NAS) devices regarding a series of active cyberattacks targeting the Plex Media Server application. The company reports that attackers are leveraging a vulnerability chain collectively referred to as Plex2Shell to gain unauthorized access to these storage systems. QNAP confirmed that it is currently assisting multiple customers who have reported suspected compromises of their devices.
The Plex2Shell exploit chain consists of four distinct vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These security flaws were originally identified and reported to Plex by researcher Zach Main on July 27. While the vulnerabilities remained private initially, exploitation activity began shortly after comprehensive technical details were disclosed publicly on October 16.
In response to the active exploitation, the Cybersecurity and Infrastructure Security Agency (CISA) added all four CVEs to its Known Exploited Vulnerabilities catalog on October 20. The agency mandated that federal organizations patch their systems by upgrading to Plex Media Server version 1.43.3.10861 or later within a three-day window, reflecting the high severity of the threat.
QNAP’s Product Security Incident Response Team has clarified that the vulnerabilities are isolated to the Plex Media Server application itself. The underlying operating systems used by QNAP hardware, including QTS and QuTS hero, are not inherently affected by these flaws. However, because these NAS devices are frequently used to host media libraries and are often exposed to the public internet, they have become a primary target for attackers seeking to leverage the Plex2Shell chain.
The vendor warns that simply updating the software is insufficient for users who may have already been compromised. QNAP advises that any NAS device running a vulnerable version of Plex that was exposed to the public internet should be treated as fully compromised. Because the update process does not automatically remove malicious payloads or backdoors installed by attackers, a more comprehensive recovery process is necessary.
Users are instructed to perform a clean reinstall of their NAS operating system and reset both their NAS and Plex credentials to ensure unauthorized access is revoked. Additionally, QNAP has provided a detailed remediation guide for affected customers. For those who suspect their systems have been breached, the company is offering to review device logs if submitted through its official technical support portal.
To mitigate future risks, QNAP recommends that users who do not require remote access to their media libraries disable the relevant features and stop forwarding port 32400 on their routers. For users who require remote connectivity, the company strongly advises against direct exposure and suggests utilizing a virtual private network (VPN) to secure the connection.
QNAP continues to urge all customers to ensure their Plex Media Server is updated to version 1.43.3.10861 or later via the QNAP App Center. By maintaining current software versions and restricting public access to administrative ports, users can significantly reduce the risk of falling victim to the Plex2Shell exploit chain.
