QNAP Now Says Plex Servers on Its NAS Devices Were Compromised Through Plex2Shell. Updating Does Not Remove What Attackers Installed, So Check Before You Trust the Patch.
If you run Plex Media Server on a QNAP NAS and it was ever reachable from the internet on version 1.43.2 or earlier, update it to 1.43.3.10861 or later, and then assume the NAS may already be compromised. QNAP said so itself in a security notice on November 6, 2026: it has received reports from "some users" that Plex on their NAS devices "appears to have been compromised" through the Plex2Shell flaws, and updating does not remove anything an attacker already installed.
What is new
We covered the CISA deadlines for this chain on October 26 in "CISA Gave One Plex Exploit Chain Two Different Federal Deadlines. Half of It Was Already Overdue." That post was about the patch and the paperwork. This one is about the first vendor statement that real devices were breached.
BleepingComputer reported QNAP's notice on November 6. QNAP says the affected software is Plex Media Server 1.43.2 and earlier, and the fix is 1.43.3.10861 or later through the App Center. QNAP states that QTS, QuTS hero and its other operating systems are "not themselves affected." The flaw is in Plex, and the QNAP part is where many people run it, often with a port forwarded to the internet.
QNAP's notice says compromised servers have been used to run cryptocurrency miners and proxy software. A proxy matters more than a miner: a NAS that relays traffic for someone else puts your address on their activity.
What QNAP does not say
QNAP gives no count of compromised devices. "Some users" and "multiple reports" are the only measures. The notice, as we read it, lists no file paths, process names, hashes, addresses or domains. Those are in a separate remediation FAQ we did not read in full. If you want a way to check, start there rather than with a number from anyone else's headline.
BleepingComputer also does not say who is exploiting the chain.
How the chain works
The researcher write-up on zmain.info describes four stages, scored 9.8 as a chain. The write-up does not say which of the four CVEs maps to which stage, and the CISA entries describe them like this.
A request to the player timeline endpoint passes the token check if the X-Plex-Token header holds any value at all. The server can then be made to send a blind POST to a destination the attacker chooses, including its own loopback interface (CVE-2026-96652).
The loopback interface for plugin agents accepts unauthenticated requests, and its guard fails to stop execution. The attacker can call another plugin's function with parameters of their choosing (CVE-2026-96654).
The server attaches the owner's admin token to any outbound request whose address begins with 127.0.0.1. A hostname that merely starts with those characters and resolves elsewhere receives the token.
The transcoder fetches attacker-supplied addresses (CVE-2026-96655), and a writable preference lets the attacker write a file. The bundled library loads every shared object in a codecs directory, so the next transcode runs the planted library as the plex user (CVE-2026-96656).
CISA added all four to its Known Exploited Vulnerabilities catalog on October 20. The write-up gives the public disclosure date as October 16.
What to do
Update Plex Media Server to 1.43.3.10861 or later through App Center, My Apps. Confirm the version in Plex Web under Settings, General.
If it ran 1.43.2 or earlier and was reachable from the internet, through Remote Access, a forwarded port 32400 or UPnP, treat the NAS as potentially compromised. QNAP says to do a clean reinstall of the operating system, check for indicators in its FAQ, and reset Plex and NAS credentials.
Before removing Plex, keep the Plex Logs folder. QNAP asks for it if you open a support case.
Turn off Plex Remote Access and stop forwarding port 32400 unless you need it. If you do, use a VPN.
Look at outbound connections from the NAS. A miner or a proxy shows up as steady traffic to addresses you do not recognize. That check is our suggestion, not QNAP's.
What our own edge saw
Since October 8 we found no match for /player/timeline or /system/agents in 47,907 blocked requests, 25,139 canary hits or 977 origin-honeypot hits. We do not run a Plex decoy, so this says our blocks did not see those paths. It does not say nobody is scanning for Plex, and it is not evidence about your NAS.
Indicators
None published by QNAP or the write-up, so nothing was added to the feed.
Limits
We read BleepingComputer, the QNAP notice and the zmain.info write-up. We did not read QNAP's remediation FAQ in full, reproduce the chain or test any device. BleepingComputer's piece refers to a figure of over 36,000 exposed servers in a related headline; the article body does not confirm it, so we do not use it.
Five percent of this is wrong somewhere. It always is. QNAP's FAQ will name the indicators we could not list.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments