QNAP warned customers on November 6, 2026, that hackers are breaching network-attached storage appliances by exploiting the Plex2Shell vulnerability chain in Plex Media Server. The company stated that it received multiple compromise reports from users whose storage units ran versions exposed to the open internet.
The attack chain combines four flaws in Plex Media Server, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Security researcher Zach Main reported the issues to Plex on July 27, assessing the complete chain at a 9.8 severity score. When linked together, the flaws let an unauthorized attacker capture an owner's administrative token and run arbitrary code with raised permissions. The Cybersecurity and Infrastructure Security Agency added all four vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026.
QNAP confirmed that the vulnerabilities exist entirely inside Plex Media Server rather than its underlying QTS or QuTS hero operating systems. However, QNAP cautioned that patching an already breached system does not eliminate planted malware. The hardware maker told users with exposed setups to treat their appliances and stored files as compromised.
Remediation Steps for Storage Owners
QNAP outlined specific actions for appliance administrators:
- Inspect the storage unit for signs of intrusion.
- Perform a clean reinstallation of the QTS or QuTS hero operating system, then change account passwords across both Plex and the storage unit.
- Install Plex Media Server version 1.43.3.10861 or newer through the QNAP App Center.
- Stop forwarding network port 32400 or disable remote connectivity entirely unless routed over a virtual private network.
