QNAP warns of live Plex2Shell attacks on NAS devices
QNAP issued an emergency notice on November 6 confirming real-world exploitation and urged Plex Media Server users to update to version 1.43.3.10861.
QNAP issued an emergency security notice on November 6 warning that attacks exploiting a Plex Media Server vulnerability, tracked as Plex2Shell, have been confirmed in real NAS environments. The notice was reported by dailysecu.com.
According to QNAP, the flaws are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, which can be chained to bypass authentication and achieve remote code execution. The affected software is Plex Media Server version 1.43.2 and earlier; users are advised to update to version 1.43.3.10861 or later.
QNAP said the vulnerability lies in Plex Media Server as installed on the NAS, not in its own NAS operating system.
Once inside, attackers can install cryptocurrency mining programs or use infected devices as proxy servers relaying other internet traffic. QNAP cautioned that on a NAS that has already been compromised, a software update alone may not remove malware or the persistence mechanisms attackers have installed.
Administrators are advised to review external access settings, abnormal processes, scheduled tasks and suspicious network connections.
Quick answers
Which Plex Media Server versions are affected by Plex2Shell?
Version 1.43.2 and earlier. QNAP advises updating to version 1.43.3.10861 or later.
Is the flaw in QNAP's NAS operating system?
No. QNAP said the vulnerability is in Plex Media Server installed on the NAS, not in its own NAS operating system.
Does updating fix an already infected NAS?
QNAP warned that a software update alone may not remove malware or persistence mechanisms on a device that has already been compromised.