QNAP NAS Devices Targeted via Exploited Plex2Shell Vulnerabilities (CVE‑2026‑96652‑96656)
What Happened — QNAP disclosed that attackers are actively exploiting a chain of four vulnerabilities (CVE‑2026‑96652, CVE‑2026‑96654, CVE‑2026‑96655, CVE‑2026‑96656) in the Plex Media Server application installed on its network‑attached storage (NAS) devices. The flaws, collectively dubbed “Plex2Shell,” allow remote code execution and privilege escalation when the Plex service is exposed to the internet. Reports of compromised QNAP NAS units began surfacing shortly after the technical details were published on 16 October 2026, and the U.S. Cybersecurity & Infrastructure Security Agency (CISA) added the CVEs to its Known Exploited Vulnerabilities catalog on 20 October 2026, urging immediate remediation. QNAP’s Product Security Incident Response Team confirmed that only the Plex application is affected; the underlying QTS/QuTS‑hero operating systems remain intact, but attackers can install persistent payloads on the host if the vulnerable Plex instance is reachable.
Why It Matters for Trust & Control Assurance — The incident underscores the need for continuous vulnerability management and evidence‑driven patch compliance across all third‑party components.
Who Is Affected — Organizations that run Plex Media Server on QNAP NAS hardware, spanning media‑production firms, SMBs, and any enterprise that uses NAS for file storage and media streaming.
Recommended Actions —
- Update Plex Media Server on all QNAP devices to version 1.43.3.10861 or later via the QNAP App Center.
- If remote access is not required, disable external Plex ports (default 32400) or block them at the firewall.
- For devices that may have been compromised, follow QNAP’s remediation guide: back up data, perform a clean reinstall of QTS/QuTS‑hero, and rotate all NAS and Plex credentials.
- Enable VPN‑only remote access for Plex and enable logging to detect anomalous activity. Source: https://www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/
Technical Notes — The Plex2Shell chain consists of two authentication bypasses, a path‑traversal flaw, and a remote code execution bug. Exploitation requires the Plex service to be reachable on the public internet (port 32400). No CVSS scores were disclosed in the article, but CISA’s “maximum priority” designation implies a high severity rating. Source: https://www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/