Pierluigi Paganini
November 09, 2026
QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices.
“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities, and QNAP Technical Support is assisting the affected usersadvisory published by QNAP. ” reads the report published by the vendor. “The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected.”
Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection.
On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors.
The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host.
The technical details are available in Main’s original analysis, Plex2Shell. Plex had been notified of the vulnerabilities on July 27 and acknowledged the report on August 4, awarding a bug bounty. The company released fixes in September, before the exploit code became public.
The loader does not check the library’s name, executable permissions, digital signature, or symbols. As a result, the library’s ELF constructor can run with the same privileges as the Plex service.
“It doesn’t check for a lib prefix, doesn’t require the execute bit, doesn’t verify any signature, and doesn’t look for any specific symbol.” reads the report published by zmain.com. “When dlopen loads a shared object, it runs the ELF’s DT_INIT_ARRAY (constructor functions) before doing any symbol resolution. A .so that only has a constructor and no exported symbols will still execute its code on load. We then trigger a second transcode. The codec directory gets re-enumerated, the .so we wrote in Stage 4 gets loaded, and the constructor runs as uid=1000(plex).”
That detail matters because the final stage can exploit how Plex loads shared libraries. The chain uses a setting related to transcoding to influence execution, allowing a specially crafted library to run when Plex loads it. The result can be code execution under the service account, without requiring the attacker to obtain an interactive login first.
QNAP urges users to update Plex Media Server immediately, users should go to App Center, open My Apps and update Plex Media Server to version 1.43.3 or later. They should then check in Plex Web, under Settings and General, that the installed version is 1.43.3.10861 or later. QNAP will release further updates after verifying them, but users should not wait.
If Plex was reachable from the internet while running version 1.43.2 or earlier, users should treat the NAS as potentially compromised. This may apply if Plex Remote Access was enabled, port 32400 was forwarded, or the port was opened automatically through UPnP or router settings. Updating alone will not remove anything an attacker may have installed.
In those cases, users should follow QNAP’s FAQ to perform a clean reinstall, check for signs of compromise and reset both their Plex and NAS credentials. The company also advises disabling Plex Remote Access if it is not needed and avoiding port forwarding for port 32400. Users who need remote access should use a VPN instead.
QNAP also recommends keeping QTS or QuTS hero and all installed apps up to date. Step-by-step instructions are available in the Plex2Shell: Check and Remediation FAQ for QNAP NAS Users.
CISA added Plex2Shell flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to addresse them by October 23, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, QNAP)
Hacking / November 09, 2026
