NewsPublished 9 Nov 2026

Plex2Shell Exploited Against QNAP NAS Users

Source SecurityWeek

Mentions 4 CVEs : update to 1.43.3

Mentioned vulnerabilities

Description

Threat actors are exploiting a chain of four vulnerabilities known as Plex2Shell in the Plex Media Server application on QNAP NAS devices. These vulnerabilities allow attackers to execute arbitrary code with Plex service privileges without requiring valid credentials. The vulnerabilities were patched in Plex Media Server version 1.43.3. QNAP NAS operating systems themselves are not affected. Users are advised to update Plex Media Server promptly and take additional precautions to secure remote access.

Impact

Successful exploitation enables attackers to execute arbitrary code on affected Plex Media Server instances without valid credentials, potentially compromising the Plex service on QNAP NAS devices. Although QNAP NAS operating systems are not affected, compromised Plex servers could lead to unauthorized control of the Plex application environment. QNAP has confirmed no data loss has occurred in reported cases but devices accessible from the internet should be considered potentially compromised.

Defensive guidance

A fix is available in Plex Media Server version 1.43.3 or later; users should update immediately. For devices exposed to the internet, Plex should be reinstalled and passwords for both Plex and the NAS rotated. Users should disable Plex Remote Access if not required or use a VPN for remote access instead of port forwarding. Keeping QTS, QuTS hero, and all installed apps up to date is also recommended. QNAP provides a step-by-step remediation guide to identify and respond to potential compromises.

References

securityweek.com/plex2shell-exploited-against-qnap-nas-users/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Nov 2026, 13:18 UTC

Technical details

References

Community reviews

Related threats