Plex2Shell: QNAP warns NAS hacked via Plex CVE-2026-96652, update to 1.43.3.10861

QNAP said on 6 November 2026 that attackers are breaking into NAS devices through Plex Media Server, using a four-bug chain called Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). The flaws are in Plex, not in QNAP's own operating system, and a fixed Plex build, 1.43.3.10861, has been out since August. But updating does not clean a server that was already hit, which is what makes QNAP's notice worth acting on today.

Key points

• Plex2Shell chains four Plex Media Server flaws into unauthenticated remote code execution; the researcher rates the full chain 9.8 (Critical) on CVSS 3.1.
• QNAP says Plex Media Server 1.43.2 and earlier is affected and that QTS and QuTS hero are not; the fix is Plex Media Server 1.43.3.10861 or later.
• The researcher, Zach Main, reported the bugs to Plex on 27 July 2026 and published details and a proof of concept on 16 October; exploitation was seen the next day.
• Attackers have installed a cryptocurrency miner and a proxy program on compromised servers, according to QNAP and BleepingComputer.
• Updating does not remove what an attacker already planted: if Plex was reachable from the internet on 1.43.2 or earlier, QNAP says to treat the NAS as potentially compromised.

What to do

Who is affected. Anyone running Plex Media Server 1.43.2 or earlier, on a QNAP NAS or elsewhere. QNAP's notice says the vulnerabilities exist only in Plex Media Server. Sources differ slightly on the boundary: QNAP's pages say "1.43.2 and earlier", while BleepingComputer describes versions before 1.43.3.10861. Either way, 1.43.3.10861 or later is the safe target.

Update. On a QNAP NAS, open App Center, then My Apps, then Plex Media Server, and choose Update. Confirm the version is 1.43.3 or later. On other systems, install the current Plex Media Server release from Plex.

Check whether you were exposed. QNAP's remediation guide says to consider the NAS potentially compromised if Plex was reachable from the internet while on 1.43.2 or earlier. That includes Remote Access being enabled, port 32400 being forwarded, UPnP opening the port, or exposure through myQNAPcloud automatic router configuration. It adds that if you only upgraded after the 16 October proof of concept, you should treat the NAS the same way.

Look for signs of a break-in. QNAP lists these indicators:

• Unknown processes started by Plex Media Server, especially myawesomeproxy, mylovelyminer or x12345.
• Unfamiliar .so or .dll files in the Codecs folder inside the PlexData shared folder.
• Outbound connections to proxystream.st.
• Sustained high CPU while nothing is playing.
• A QNAP Malware Remover detection such as code MR2104.

If you find any of them, do not just delete the file. QNAP says other components or persistence may remain and recommends a clean reinstall: copy the Plex Logs folder somewhere safe first if you may want QNAP's help, remove Plex Media Server, delete or at least empty the Codecs folder and review Preferences.xml for transcoder options you did not set, then reinstall 1.43.3 or later without restoring the old Codecs contents. Afterwards sign out all Plex devices before changing your Plex password, change NAS passwords, turn on two-step verification and rotate credentials used by backup jobs and cloud connections.

Reduce exposure. If you do not need remote access, turn off Plex Remote Access and remove the port 32400 forward, and disable UPnP. If you do need it, use a VPN such as QNAP's QVPN Service rather than a public port.

What happened

The researcher's write-up, titled "Unauthenticated RCE in Plex Media Server", describes how four weaknesses combine. The first stage needs no login: the /player/timeline endpoint only checks that an X-Plex-Token header is present, so a junk value passes. The attacker needs network access to port 32400 and a server of their own to host a payload and a DNS name.

BleepingComputer, citing CISA's description of the four CVEs, summarises them like this:

• CVE-2026-96652: a server-side request forgery in /player/timeline that lets an unauthenticated attacker make Plex send POST requests to arbitrary destinations, including its own internal APIs.
• CVE-2026-96654: a URL injection in searchOne that lets an attacker call other plugins' functions with attacker-controlled parameters.
• CVE-2026-96655: an authenticated SSRF in the transcoder endpoint.
• CVE-2026-96656: an arbitrary file write in the transcoder settings, which lets an administrator plant shared libraries that Plex later loads.

QNAP's notice says the four individually present limited risk but together let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. On 6 November QNAP said it had received reports of compromised NAS devices and that Plex had confirmed the flaws are being "actively and widely exploited".

Background

The timeline, as reported by the researcher and BleepingComputer:

• 27 July 2026: Main reports the flaws to Plex.
• 4 August: Plex acknowledges them and pays a bounty. BleepingComputer says version 1.43.3.10861 was released on this date.
• 1 September: Plex announced the fixes, and its advisory told server owners to install the newest release without delay, according to SecurityWeek.
• 23 September: CVE identifiers assigned, per the researcher's write-up.
• 16 October: public write-up and proof-of-concept code. SecurityWeek reports that an internet-facing honeypot saw the first in-the-wild exploitation on 17 October, a day later.
• CISA: added the flaws to its Known Exploited Vulnerabilities catalog and told federal agencies to patch by 23 October, according to BleepingComputer. We could not confirm the exact date of the listing from the pages we opened.
• 6 November: QNAP issues its advisory.

The gap between the fix in August and the attacks in late October is the usual pattern for consumer and small-office servers: the vendor patches, a researcher publishes the details, and anyone who has not updated becomes a target within a day.

How it works

The researcher's account of the chain, in five steps:

1. Request forgery. The companion protocol's subscription callback builds a URL from unvalidated player-supplied parameters, so the attacker can make the server send a blind POST to itself on the loopback interface.
2. Loopback pivot. The /system/agents/* API trusts requests from loopback. A broken guard in searchOne and an unencoded identifier let the attacker call arbitrary plugin functions.
3. Token theft. A plugin function fetches attacker-chosen URLs, and the framework attaches the owner's admin token to any URL that starts with http://127.0.0.1. Because that prefix check is unbounded, the token can be sent to an attacker-controlled host.
4. Payload delivery. With admin access, the attacker changes a transcoder preference that writes decoded media frames to a chosen path in the codec directory.
5. Code execution. The transcoder loads every .so file in that directory at startup, so the planted library runs as the Plex service user.

That last step explains QNAP's advice about the Codecs folder: an unfamiliar library file there is the clearest sign the chain ran.

What it means

For home users the lesson is about exposure. A media server on a NAS is often reachable from the internet so that friends or phones can stream, and that single forwarded port was enough here. A NAS typically holds backups and personal files as well, which is why QNAP tells exposed users to assume the worst and reset credentials.

For small offices and homelab operators, it is another reminder that app-level flaws on a NAS are not covered by the NAS vendor's own patches. QNAP stressed that QTS and QuTS hero are not affected, so keeping the firmware current does nothing for this bug; the Plex app has to be updated separately.

What we don't know yet

• How many servers were compromised. Neither QNAP's notice nor the articles we read gives a count of affected or still-exposed servers.
• Exact severity per bug. Scores differ between sources and scoring versions. BleepingComputer says the individual flaws are medium to high and the chain 9.8; the researcher gives 9.8 for the chain; other outlets quote different numbers for individual CVEs. Check the CVE records before relying on one figure.
• The affected-version boundary. QNAP says 1.43.2 and earlier; BleepingComputer says before 1.43.3.10861. We have not seen Plex's own advisory text.
• Other payloads. Reports so far name an XMRig-based miner and a proxy tool. More may exist.

What to watch next

Watch for Plex's own statement on the exploitation and for any further QNAP guidance in its remediation FAQ. If you run Plex on another NAS brand or a home server, expect similar advisories from those vendors.

Sources

• QNAP security notice: Plex Media Server vulnerabilities (Plex2Shell), 6 November 2026
• QNAP: Plex2Shell check and remediation FAQ for QNAP NAS users
• Zach Main: Unauthenticated RCE in Plex Media Server
• BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks
• BleepingComputer: CISA: hackers chain Plex flaws in Plex2Shell attacks to breach servers
• SecurityWeek: Plex2Shell exploit chain weaponized against Plex servers hours after disclosure