{"id":12477,"date":"2026-11-06T11:46:05","date_gmt":"2026-11-06T17:46:05","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-146-active-exploitation-of-plex2shell-on-qnap-nas\/"},"modified":"2026-11-06T11:48:58","modified_gmt":"2026-11-06T17:48:58","slug":"alert-2026-146-active-exploitation-of-plex2shell-on-qnap-nas","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-146-active-exploitation-of-plex2shell-on-qnap-nas\/","title":{"rendered":"Alert 2026-146 Active exploitation of Plex2Shell on QNAP NAS"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
Plex Media Server<\/strong><\/td>Earlier than 1.43.3.10861 (QNAP lists 1.43.2 and earlier)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The vulnerabilities are in Plex Media Server, not in QTS or QuTS hero. They also affect installations on Windows, macOS, Linux, Docker, and other NAS devices with the same version threshold.<\/p>\n\n

Description<\/h2>\n\n

Active exploitation of a chain of vulnerabilities in Plex Media Server, known as Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), has been reported. On Nov 6, 2026, QNAP stated that it had received reports from users whose NAS devices running Plex Media Server appeared to have been compromised through these vulnerabilities. The vulnerabilities reside in the third-party application; QNAP stated that QTS, QuTS hero, and other operating systems from the vendor are not affected in themselves.<\/p>\n\n

Separately, each CVE presents limited individual risk: CVE-2026-96652 and CVE-2026-96655 have a CVSS score of 4.3 (medium); CVE-2026-96654 has a CVSS score of 6.5 (medium); CVE-2026-96656 has a CVSS score of 7.2 (high). When chained, according to Plex and QNAP, they allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the Plex Media Server process. It is not asserted here that each CVE individually is an unauthenticated RCE or that it grants root or administrator privileges in all deployments.<\/p>\n\n

According to Plex, the vulnerabilities have been actively and widely exploited since the publication of a proof of concept on Oct 16, 2026; Internet-accessible unpatched servers have been used to run cryptocurrency miners and proxy software. All four CVEs have appeared in known exploited vulnerability catalogs since Oct 20, 2026. The same version threshold affects Plex Media Server on Windows, macOS, Linux, Docker, and other NAS devices, not only QNAP.<\/p>\n\n

Plex’s provider advises updating to 1.43.3.10861 or later and validating the installed build: the \u201c1.43.3\u201d tag alone is not sufficient. QNAP summarizes the affected versions as 1.43.2 and earlier. Updating does not remove payloads already installed. If the server was exposed to the Internet with a vulnerable version (for example, through Remote Access, port 32400 forwarding, or automatic opening via UPnP), according to Plex it should be considered potentially compromised.<\/p>\n\n

Mitigation<\/h2>\n\n

While the system is being updated and any compromise is assessed, it is recommended to:<\/p>\n\n