I’M UNDER A CYBER ATTACK

Alert

Logo de QNAP

Alert 2026-146 Active exploitation of Plex2Shell on QNAP NAS

Affected product(s): 

ProductAffected versions
Plex Media ServerEarlier than 1.43.3.10861 (QNAP lists 1.43.2 and earlier)

The vulnerabilities are in Plex Media Server, not in QTS or QuTS hero. They also affect installations on Windows, macOS, Linux, Docker, and other NAS devices with the same version threshold.

Description

Active exploitation of a chain of vulnerabilities in Plex Media Server, known as Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), has been reported. On Nov 6, 2026, QNAP stated that it had received reports from users whose NAS devices running Plex Media Server appeared to have been compromised through these vulnerabilities. The vulnerabilities reside in the third-party application; QNAP stated that QTS, QuTS hero, and other operating systems from the vendor are not affected in themselves.

Separately, each CVE presents limited individual risk: CVE-2026-96652 and CVE-2026-96655 have a CVSS score of 4.3 (medium); CVE-2026-96654 has a CVSS score of 6.5 (medium); CVE-2026-96656 has a CVSS score of 7.2 (high). When chained, according to Plex and QNAP, they allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the Plex Media Server process. It is not asserted here that each CVE individually is an unauthenticated RCE or that it grants root or administrator privileges in all deployments.

According to Plex, the vulnerabilities have been actively and widely exploited since the publication of a proof of concept on Oct 16, 2026; Internet-accessible unpatched servers have been used to run cryptocurrency miners and proxy software. All four CVEs have appeared in known exploited vulnerability catalogs since Oct 20, 2026. The same version threshold affects Plex Media Server on Windows, macOS, Linux, Docker, and other NAS devices, not only QNAP.

Plex’s provider advises updating to 1.43.3.10861 or later and validating the installed build: the “1.43.3” tag alone is not sufficient. QNAP summarizes the affected versions as 1.43.2 and earlier. Updating does not remove payloads already installed. If the server was exposed to the Internet with a vulnerable version (for example, through Remote Access, port 32400 forwarding, or automatic opening via UPnP), according to Plex it should be considered potentially compromised.

Mitigation

While the system is being updated and any compromise is assessed, it is recommended to:

  • If remote access to Plex is not needed, disable Remote Access and do not forward port 32400; if it is needed, prefer a VPN.
  • Keep QTS or QuTS hero and installed applications up to date.
  • If compromise is suspected, preserve the Plex log folder before removing the application and open a case with the NAS vendor’s support team when applicable.
  • Log out of all devices on the Plex account and change the password; treat resources accessible by the Plex service account as potentially exposed (mounted shares and credentials on the same machine).

Detection

The following indicators come from Plex’s official advisory. They are indicators to investigate, not conclusive proof on their own; process names are examples and not an exhaustive list. No official hashes were found in the actual Plex and QNAP advisories reviewed.

  • Unknown Plex child processes, for example myawesomeproxy, mylovelyminer, or x12345.
  • Unknown .so or .dll files in Plex’s Codecs folder.
  • Transcoding options in Preferences.xml that the administrator did not configure.
  • Outbound connections to proxystream[.]st (domain published by Plex; it was not visited).
  • High and sustained CPU usage without content playback (nonspecific indicator).
  • Prior exposure through port 32400, Remote Access, or UPnP: these are exposure conditions, not indicators of compromise by themselves.

Solution

The preventive solution is to update Plex Media Server to version 1.43.3.10861 or later (on QNAP NAS, from App Center > My Apps) and confirm the build in Plex Web under Settings > General. Distinguish the preventive patch from the remediation of a possible compromise: if the server was exposed with a vulnerable version, updating does not clean anything an attacker may have installed. According to Plex, if there are signs of compromise or compromise cannot be ruled out, rebuild the server with a clean installation without reusing the old Plex data directory; at a minimum, empty the Codecs folder and review Preferences.xml. QNAP directs users to its Plex2Shell checking and remediation FAQ for steps on NAS devices.

For information on how to update, visit the following link:

https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately

Additional information: