QNAP has received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices. These incidents are linked to the Plex2Shell vulnerabilities, which are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Exploitation of these vulnerabilities began shortly after proof-of-concept code was made public on October 16, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026.
Attackers have reportedly used compromised servers for cryptocurrency mining and proxy services. The vulnerabilities allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the Plex Media Server process.
QNAP advises users to treat their NAS devices as potentially compromised if they were running vulnerable Plex servers exposed to the internet. Users are recommended to update Plex Media Server to version 1.43.3.10861 or later to protect against Plex2Shell attacks.
QNAP's operating systems, QTS and QuTS hero, are not affected by these vulnerabilities. Users are advised to perform a clean reinstall of the OS and reset credentials if their NAS was compromised.