Update Plex on QNAP NAS now: Plex2Shell flaws are being exploited

Published 7 November 2026 by oowl. General information for Australian small businesses, not advice for any particular organisation.

What happened

On 6 November QNAP published a security notice saying some customers running Plex Media Server on their QNAP NAS appear to have been compromised. The cause is a set of four flaws in Plex itself, known as Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). Chained together, they let an attacker with no login run code on the device with the permissions of the Plex app.

Full technical details were published in mid-October and attacks followed within days. The US cyber agency CISA added all four flaws to its Known Exploited Vulnerabilities catalog on 20 October, BleepingComputer reported. According to QNAP, compromised servers have been used to run cryptocurrency miners and proxy software.

QNAP says its own operating systems, QTS and QuTS hero, are not affected. The problem is the Plex app installed on top of them.

Who is affected

Any business with a QNAP NAS running Plex Media Server version 1.43.2 or earlier. The risk is highest where Plex was reachable from the internet: Plex Remote Access turned on, port 32400 forwarded on the router, or the port opened automatically through UPnP or myQNAPcloud router configuration.

A NAS often holds shared files and backups, so a compromised box is worth taking seriously even if Plex was only ever used for staff training videos or a waiting-room screen. The flaws are in Plex, not QNAP, so a Plex server on any other device should get the same update.

What to do

1. Update Plex. In the QNAP App Center under My Apps, update Plex Media Server, then confirm in Plex Web (Settings, General) that it shows 1.43.3.10861 or later. QNAP advises not to wait for a later release.
2. Close the door to the internet. If nobody needs to reach Plex from outside the office, turn off Plex Remote Access and remove any port 32400 forward, UPnP rule or myQNAPcloud rule for it. If remote access is needed, put it behind a VPN.
3. If Plex was exposed while out of date, assume compromise. QNAP is clear that updating does not remove anything an attacker has already installed. Follow its check and remediation FAQ: look for unknown processes started by Plex, unfamiliar files in the Plex Codecs folder and unexplained high CPU use, then do the clean reinstall it describes.
4. Reset passwords. Sign out all Plex devices and change the Plex password, change NAS admin and user passwords, turn on two-step verification, and change any passwords for other services stored on the NAS.
5. Keep the rest current. Update QTS or QuTS hero and every installed app. Keeping internet-facing devices patched is a core part of the Essential Eight.
6. Get help if unsure. Before removing Plex, keep a copy of its Logs folder and open a case with QNAP Technical Support. If you think business data was accessed, report it through ReportCyber at cyber.gov.au.

Sources

• QNAP Security Notice: Plex Media Server vulnerabilities (Plex2Shell), QNAP
• Plex2Shell: Check and Remediation FAQ for QNAP NAS Users, QNAP
• QNAP says hackers breaching NAS devices in Plex2Shell attacks, BleepingComputer
• CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers, BleepingComputer

oowl writes each brief in its own words from the public sources listed. Check the sources for the latest detail, because advisories are often updated after publication. More briefs: all threat briefs or the Atom feed.