Skip to content
QNAP Warns of Ongoing Plex2Shell Attacks on NAS Devices

QNAP Warns of Ongoing Plex2Shell Attacks on NAS Devices

First seen 6 Nov 2026, 18:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 18:16 UTC
  • •QNAP advises immediate updates to Plex Media Server to prevent exploitation.
  • •Four vulnerabilities in Plex Media Server allow remote code execution.
  • •Compromised servers have been used for cryptocurrency mining and proxy services.

QNAP has issued an urgent advisory regarding ongoing attacks exploiting the Plex2Shell vulnerability chain, affecting its NAS devices. Users are urged to update Plex Media Server to version 1.43.3.10861 or later to mitigate risks. The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, were disclosed on September 23, 2026, and exploitation began shortly after proof-of-concept code was made public on October 16. Attackers have reportedly used compromised servers for cryptocurrency mining and proxy services. QNAP advises users to treat their devices as potentially compromised if they were running vulnerable versions exposed to the internet. The company is assisting affected users and recommends a clean reinstall of the OS and resetting credentials. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3d ago How this analysis works

Timeline

2026-09-23
Plex2Shell vulnerabilities published
Four vulnerabilities in Plex Media Server were disclosed, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Bleepingcomputer
2026-09-23
CVE-2026-96656 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96654 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96655 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96652 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-16
Public proof-of-concept code released
Details for exploiting the Plex2Shell vulnerabilities were made public, leading to active attacks.
Cyberinsider
2026-10-20
CISA adds vulnerabilities to KEV catalog
CISA added the Plex2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, urging immediate updates.
Bleepingcomputer
2026-11-06
QNAP issues urgent advisory
QNAP warns users to update Plex Media Server immediately and treat potentially compromised NAS devices as such.
Cyberinsider

More articles in this cluster (13)

Following this threat?

Track Qnap and CVE-2026-96652 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2

Common questions

Which versions of Plex Media Server are affected?
Plex Media Server versions 1.43.2 and earlier are affected by the vulnerabilities.
What should I do if my NAS was exposed?
If your NAS was running a vulnerable Plex server exposed to the internet, treat it as potentially compromised and follow QNAP's remediation steps.
Is there evidence of exploitation?
Yes, reports indicate that attackers have exploited these vulnerabilities for cryptocurrency mining and proxy services.