QNAP says some Plex Media Server installations on its NAS devices appear to have been compromised through Plex2Shell, a four-vulnerability chain affecting older Plex Media Server builds.
Plex2Shell names a chain of four Plex Media Server vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Plex says the bugs can be chained to let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.
Plex said a public proof of concept was released on October 16. Since then, according to Plex, internet-facing servers that had not been updated have been widely attacked, with compromised systems used for cryptocurrency miners and proxy software that routes other people’s traffic through the affected connection. QNAP issued its security notice on November 6, 2026, after Plex’s report.
QNAP says its Product Security Incident Response Team confirmed that the vulnerabilities are in Plex Media Server, not in QNAP operating systems. QTS, QuTS hero, and other QNAP operating systems are not themselves affected by the Plex2Shell flaws.
Why exposed servers may need recovery work
QNAP says updating closes the entry point but does not remove anything attackers may have installed.
If a vulnerable Plex server was reachable from the internet, QNAP says the NAS should be treated as potentially compromised. The concern is not only the Plex app itself. QNAP’s FAQ says shared folders that Plex Media Server could access, and credentials stored on the NAS, should be treated as potentially exposed in those cases.
QNAP has not published a number of affected devices. Its notice says the company has received reports from some users and that QNAP Technical Support is assisting affected users.
Who should treat a QNAP NAS as potentially compromised
QNAP’s remediation FAQ says owners should treat the NAS as potentially compromised if any of the following applied while Plex Media Server 1.43.2 or earlier was running:
Plex Remote Access was enabled.
The router forwarded port 32400 to Plex.
UPnP was enabled on the router while Plex Remote Access was enabled.
Plex was exposed through myQNAPcloud auto router configuration or another remote-access method.
QNAP also flags an upgrade after the public proof of concept appeared on October 16 as a reason to check for compromise. If you can confirm that Plex was never reachable from the internet, QNAP says updating is enough and recommends reducing exposure where possible. A QNAP NAS without Plex Media Server installed does not need Plex2Shell-specific action.
Signs QNAP says to check
QNAP’s FAQ lists several indicators that may point to compromise. They include:
unknown processes started by Plex Media Server, especially names such as myawesomeproxy, mylovelyminer, or x12345;
unfamiliar .so or .dll files in the Plex Codecs folder;
outbound connections to proxystream.st;
sustained high CPU use while nothing is playing;
a QNAP Malware Remover detection, including detection code MR2104.
If those signs appear, QNAP advises against simply removing one suspicious file or process. Other components may remain. The company recommends preserving the Plex Logs folder first if QNAP support review is needed, then following its reinstall, compromise-check, and credential-reset guidance.
What affected owners should do now
QNAP’s immediate recommendation is to update Plex Media Server through App Center and confirm in Plex Web under Settings > General that the version is 1.43.3 (build 1.43.3.10861) or later. QNAP says later Plex versions will also be published in App Center once verified, but owners should not wait for later releases because 1.43.3.10861 fixes Plex2Shell.
For internet-exposed vulnerable servers, QNAP recommends a more involved response. That includes removing Plex Media Server, checking whether the old Plex Media Server folder remains in the PlexData shared folder, and reinstalling the fixed version without reusing the old Codecs folder or its contents.
QNAP also recommends signing out all devices from the Plex account settings before changing the Plex password. The company says the administrator token may have been exposed, so changing the password alone is not enough. NAS administrator and user passwords should also be changed, two-step verification should be enabled, and passwords or access keys stored by other services on the NAS should be rotated where relevant.
To reduce exposure, QNAP recommends disabling Plex Remote Access if it is not required, removing the port 32400 forwarding rule, disabling UPnP, and removing any myQNAPcloud auto router configuration for Plex. If remote access is needed, QNAP recommends using a VPN instead of exposing Plex directly.
CISA also flagged the Plex flaws
The U.S. Cybersecurity and Infrastructure Security Agency added all four Plex vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026, based on evidence of active exploitation.
CISA’s remediation requirements apply to U.S. federal civilian agencies, but the agency also encourages other organizations to prioritize KEV-listed vulnerabilities by risk. For small businesses and home labs running NAS devices, that listing supports treating Plex2Shell as an active exploitation issue rather than a theoretical software bug.
The QNAP notice highlights a recurring risk for network-attached storage devices: third-party apps can become the entry point to systems that hold backups, media libraries, shared folders, and sometimes stored service credentials.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
