QNAP has announced that it has received reports indicating that its Network Attached Storage (NAS) devices are being compromised through the exploitation of a chain of security vulnerabilities known as "Plex2Shell." These attacks target the Plex Media Server application installed on storage devices, creating a security hole that may lead to unauthorized access to personal data and stored files.
Vulnerability Details and Timeline
"Plex2Shell" consists of a chain of four security vulnerabilities tracked under the identifiers (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656). Security researcher Zach Main discovered these vulnerabilities last July; however, actual exploitation began following the publication of full technical details on October 16, 2026. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its "Known Exploited Vulnerabilities" catalog, directing federal agencies to prioritize immediate updates.
Scope of Impact: Application vs. Operating System
In an important clarification to reduce concerns regarding device integrity, the QNAP Product Security Incident Response Team (QNAP PSIRT) confirmed that these vulnerabilities are limited exclusively to the Plex Media Server application. QNAP's underlying operating systems, such as QTS and QuTS hero, are not directly affected by these vulnerabilities; rather, the risk lies within the application running on top of these systems.
What This Means for Users and How to Respond
The real danger lies in the fact that a software update alone may not be sufficient if the device has already been compromised. QNAP warned that the update will not remove any malicious software (payloads) that attackers may have previously planted within the system.
To ensure data protection, the company advises following these steps:
- Immediate Update: Upgrade the Plex Media Server application to version 1.43.3.10861 or later via the QNAP App Center.
- Comprehensive Recovery Procedures: If a breach is suspected, perform a clean reinstallation of the operating system (QTS or QuTS hero), then reset all Plex credentials and the entire NAS device.
- Reduce Attack Surface: If you do not need remote access to Plex, it is best to disable these features and stop port forwarding (Port 32400). If remote access is necessary, it is strongly recommended to use a Virtual Private Network (VPN) to secure the connection.