QNAP says hackers breaching NAS devices in Plex2Shell attacks

QNAP prompts users to upgrade Plex Media Server to the current variation offered in the QNAP App Center, as hackers are making use of the Plex2Shell vulnerability chain.

The supplier stated it had actually gotten numerous reports of presumed compromises including clients’ network-attached storage (NAS) gadgets.

“QNAP has actually gotten reports from some users that Plex Media Server on their NAS appears to have actually been jeopardized through vulnerabilities, and QNAP Technical Support is helping the impacted users,” the business states in an advisory today.

Plex2Shell is a chain of 4 vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Security scientist Zach Main found and reported the defects to Plex on July 27. Exploitation began quickly after the complete technical information ended up being public on October 16.

CISA included all 4 defects to its Known Exploited Vulnerabilities brochure on October 20, 2026, advising federal firms to update to Plex 1.43.3.10861 or later on within 3 days, offering it optimal concern.

QNAP’s NAS gadgets are specialized computer systems with integrated storage that enable users to shop, gain access to, and share files throughout a network. They are generally utilized to support computer systems and shop media files.

Users can likewise broaden their gadgets’ abilities by setting up applications from the QNAP App Center, such as Plex Media Server, which streams films, television programs, and music straight from NAS drives.

QNAP recommends users to upgrade Plex Media Server to the most recent variation readily available through the QNAP App Center, presently 1.43.3.10861, to secure versus Plex2Shell attacks.

“The QNAP Product Security Incident Response Team (QNAP PSIRT) has actually verified that the vulnerabilities exist just in Plex Media Server; QTS, QuTS hero, and other QNAP os are not themselves impacted,” the supplier states.

User action needed

QNAP states that users ought to treat their NAS gadgets and all individual material as jeopardized if they’re running a susceptible Plex server that is exposed on the general public web.

The supplier cautioned that upgrading now will not eliminate any payloads the enemies have actually currently set up on the gadget.

The suggested action is to look for the indications of compromise shared in the security publicationcarry out a tidy reinstall of the OS (QTS or QuTS hero), and after that reset Plex and NAS qualifications.

Users who do not require to gain access to Plex from another location must disable the associated functions and stop forwarding port 32400. Those who require remote gain access to are recommended to link by means of VPN.

QNAP has actually launched a comprehensive detailed removal guide on how to do the above.

The business likewise provides to examine logs from thought compromises, which users can send through QNAP’s technical assistance website.

Discover e-mail hazards your existing defenses might miss out on.

Adaptive Security’s AI representatives examine e-mail intent, context, and habits to reveal phishing, organization e-mail compromise, and billing scams.

See what’s surviving with a 14-day read-only scan of Microsoft 365 or Google Workspace, without any MX modifications.

Start your totally free e-mail security scan.