Overview
- QNAP confirmed Monday that it has received reports of active exploitation that uses a four‑vulnerability chain in Plex Media Server to compromise Plex apps on QNAP NAS devices.
- The Plex2Shell chain combines CVE‑2026‑96652, CVE‑2026‑96654, CVE‑2026‑96655 and CVE‑2026‑96656 and can yield unauthenticated remote code execution by abusing path traversal, unsafe deserialization and Plex’s shared‑library loading behavior.
- Plex released fixes in the summer and QNAP now urges all users to update Plex to version 1.43.3 or later, reinstall Plex on devices that were internet‑accessible, rotate Plex and NAS credentials, and disable or limit remote access.
- Detection steps include looking for Plex spawning unexpected shell processes, new files written by the Plex service user, unusual outbound connections, and log entries showing suspicious library or transcode activity.
- Because many QNAP App Center installs remain outdated, attackers have quickly weaponized a mid‑October public proof‑of‑concept to deploy miners and proxy/backdoors, and QNAP says users who exposed Plex to the internet should assume possible compromise and follow its remediation guide.