QNAP Warns of Plex2Shell Vulnerability Exploits Targeting NAS Devices, Urging Application Updates
Cybersecurity and privacy
QNAP issued a security advisory warning that Plex Media Server on users' NAS devices was reportedly targeted by Plex2Shell exploits. The flaw exists solely within Plex; QTS and QuTS hero operating systems remain unaffected, with no reported data loss. Users are urged to update to version 1.43.3.10861 or later.
Taiwanese NAS maker QNAP published a security advisory on November 6 stating that users reported alleged in-the-wild exploitation of the Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) targeting Plex Media Server installed on NAS devices. QNAP support teams responded and confirmed no reported data loss. QNAP PSIRT clarified that the vulnerability chain affects only Plex Media Server, while QTS and QuTS hero operating systems remain unaffected and do not ship with the app preinstalled. QNAP urges users with the app installed to upgrade to version 1.43.3.10861 or newer and inspect their devices following official guidance if the service was exposed directly to the internet.
Key takeaways
- Following the public disclosure of the Plex2Shell vulnerability chain, QNAP received user reports indicating active exploitation attempts against Plex Media Server on NAS devices.
- QNAP PSIRT verified that the vulnerability chain is confined to Plex Media Server, leaving QTS and QuTS hero OS unaffected, with no data loss reported so far.
- QNAP advised users to upgrade Plex to version 1.43.3.10861 or later and recommended security checks for devices exposed directly to the internet.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.