QNAP warns hackers are breaching NAS devices via Plex2Shell

On November 6, QNAP said hackers have been breaching customer NAS devices through the Plex2Shell vulnerability chain in Plex Media Server. The company has received reports from users that Plex on their NAS "appears to have been compromised," and its technical support team is assisting them.

The chain consists of four flaws: CVE-2026-96656, CVE-2026-96655, CVE-2026-96654 and CVE-2026-96652. Researcher Zach Main reported them to Plex on July 27. Technical details were published on October 16, and attacks began soon after. 2-Spyware reported that individual scores range from 5.3 to 8.6 and that chained exploitation is rated 9.8 critical. On October 20, CISA added all four to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to install Plex 1.43.3.10861 or a later release.

QNAP's PSIRT said the flaws exist only in Plex Media Server, and that its own operating systems are unaffected. The fixed version is 1.43.3.10861, available in the QNAP App Center. Patching does not remove payloads that attackers have already installed, so QNAP advises users whose Plex server was reachable from the internet to treat the device and its contents as compromised.

For remediation, QNAP says to check the security bulletin for signs of compromise, perform a clean reinstall of QTS or QuTS hero, and then change Plex and NAS credentials. Anyone who does not need remote Plex access should disable those features and stop forwarding port 32400; remote users should connect through a VPN instead. QNAP offers a detailed remediation walkthrough and will examine logs sent through its support portal.

A researcher running a decoy Plex server observed attackers dropping an XMRig coin miner and a proxy called myawesomeproxy after the exploit became public, 2-Spyware reported. The same outlet noted that QNAP did not provide a count of affected devices.