Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server
Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.
SecurityWeekNov 9, 2026Translated from English