QNAP says Plex servers on its NAS devices are being breached in Plex2Shell attacks
QNAP says it has reports from some users that Plex Media Server on their NAS was compromised through the Plex2Shell flaws, and that patching won't remove what attackers already left behind.
QNAP says it has received reports from some users that Plex Media Server on their NAS devices appears to have been compromised through the Plex2Shell vulnerabilities, and that its technical support is helping those users. The advisory went out on November 6, 2026.
Plex2Shell is a chain of four flaws in Plex Media Server. Two of them are SSRF and a URI-scheme handling bug that let an attacker reach other plugins' functions; the chain is what makes the individual bugs worth more than their scores suggest. Security researcher Zach Main reported the flaws to Plex on July 27, and exploitation started shortly after full technical details went public on October 16. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20, 2026, with a three-day deadline for federal agencies to reach Plex 1.43.3.10861 or later.
QNAP's PSIRT says the flaws exist only in Plex Media Server, and that QTS, QuTS hero and other QNAP operating systems aren't themselves affected. It points users to the latest Plex build in the QNAP App Center, currently 1.43.3.10861.
The part worth reading twice: updating doesn't remove payloads already on the box. QNAP's advice for anyone running a vulnerable Plex server exposed to the public web is to treat the NAS and everything stored on it as compromised, check the bulletin's signs of compromise, do a clean reinstall of QTS or QuTS hero, then reset Plex and NAS credentials. If remote access isn't needed, turn it off and stop forwarding port 32400; if it is, use a VPN. QNAP will also look at logs submitted through its support portal.
We'd treat an internet-facing Plex install on a NAS as a live incident until it's been rebuilt, not just updated. The advisory doesn't say how many devices are involved.
CVE references
Sources
- QNAP says hackers breaching NAS devices in Plex2Shell attacksPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning