Malicious actors are exploiting Plex2Shell to hijack Plex Media Server applications on QNAP NAS devices, warns Taiwanese storage and networking solutions provider QNAP.
Plex2Shell is a chain of four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656) in Plex Media Server that was patched this summer.
Widespread exploitation of the four-fault chain began in mid-October, following the release of technical details and proof-of-concept (PoC) code.
Successful exploitation of Plex2Shell does not require valid credentials and could allow attackers to execute arbitrary code on exposed servers, with the privileges of the Plex service.
Plex Media Server is available as a third-party application for QNAP NAS users, through the official App Center.
“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised by these vulnerabilities,” the Taiwanese company said. warned Friday.
“The QNAP technical support team is assisting affected users and has confirmed that no data loss has occurred. The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities only exist in Plex Media Server; QTS, QuTS hero and other QNAP operating systems are not affected themselves,” it added.
QNAP NAS users are advised to update to Plex Media Server version 1.43.3 or later as soon as possible.
Devices accessible from the Internet should be considered potentially compromised and Plex should be reinstalled, QNAP says, adding that Plex and NAS passwords should be alternated immediately.
“If you don’t need remote access to Plex, turn off Plex Remote Access and don’t forward port 32400. If you need remote access, use a VPN instead. Also make sure QTS or QuTS Hero and all installed apps are up to date,” QNAP says.
The company released a step-by-step remediation guide to help users identify and respond to potential compromises.
Related: Hackers exploit “SSHole” authentication bypass in OpenSSH
Related: Chrome 157 rolls out with 213 security fixes, including seven deemed critical
Related: Critical Node-RED flaw exploited in attacks
Related: Ivanti Fixes Two More Zero-Days Exploited in Secure Connect Attack Chain
