Synology Patches Four Plex2Shell Flaws in NAS Media Server Package
The update, detailed in advisory Synology-SA-26:17, fixes flaws that could be chained to bypass authentication and achieve remote code execution.
Synology released an update on November 8, 2026, fixing four security vulnerabilities in the Plex Media Server package used on its NAS devices, according to the company's official advisory Synology-SA-26:17.
The flaws include two server-side request forgery issues, CVE-2026-96652 and CVE-2026-96655, both rated CVSS 4.3, along with a URL validation issue, CVE-2026-96654, at CVSS 6.5, and an arbitrary file write issue, CVE-2026-96656, rated CVSS 7.2.
According to Synology, chaining the vulnerabilities could allow an attacker to bypass authentication and achieve remote code execution.
The fixes arrive in Plex Media Server 1.43.5.11079-720011079 or later for DSM 7.4 and 7.3, and in 1.43.5.11079-700011079 or later for DSM 7.2.2 and 7.2.1.
The vulnerabilities sit in the separately installed Plex Media Server package rather than in DSM itself, so updating the operating system alone does not address them and a separate package update is required.
Exploitation concerns
Two days before the advisory, on November 6, 2026, NAS maker QNAP said suspected real-world exploitation cases had been reported for the same Plex2Shell vulnerabilities, dailysecu.com reported.
Quick answers
Which Plex Media Server version fixes the Synology vulnerabilities?
Synology lists Plex Media Server 1.43.5.11079-720011079 or later for DSM 7.4 and 7.3, and 1.43.5.11079-700011079 or later for DSM 7.2.2 and 7.2.1.
Does updating DSM fix the Plex2Shell flaws?
No. The vulnerabilities are in the separately installed Plex Media Server package, so a separate update is required.
How severe are the Plex2Shell vulnerabilities?
CVE-2026-96652 and CVE-2026-96655 are rated CVSS 4.3, CVE-2026-96654 is CVSS 6.5 and CVE-2026-96656 is CVSS 7.2. Chaining them could enable authentication bypass and remote code execution.