QNAP urges NAS users to patch critical Plex2Shell vulnerabilities

QNAP has issued an urgent security advisory urging users of its network-attached storage devices to update their systems. Hackers are currently exploiting a dangerous multi-flaw chain known as Plex2Shell to compromise servers.

• QNAP received reports of potential compromises involving NAS customers.
• Plex2Shell consists of four distinct vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
• Active exploitation surged shortly after full technical details became public in October.

Understanding the Plex2Shell Vulnerability Chain Security researcher Zach Main originally discovered these flaws and reported them to Plex in late July. Exploitation attempts accelerated after technical specifics were published in mid-October, prompting CISA to add all four flaws to its Known Exploited Vulnerabilities catalog. QNAP's Product Security Incident Response Team confirmed that the security issues reside solely within Plex Media Server. The core storage operating systems, QTS and QuTS hero, remain unaffected by the underlying bugs.

Remediation Steps for Affected Users Users must update Plex Media Server to the latest available version through the QNAP App Center to mitigate ongoing risks. However, the vendor warns that updating alone will not remove existing payloads if a device was already breached while exposed to the public internet. Affected individuals are advised to perform a clean operating system reinstallation, reset credentials, and disable remote access features if they are not strictly necessary. Those requiring remote connectivity should switch to a secure VPN connection.

Security Impact and Best Practices Network-attached storage devices hold critical backups and personal media files, making them prime targets for cybercriminals. This campaign underscores the critical importance of keeping third-party applications updated and avoiding unnecessary exposure of server ports to the open web.