The vendor said it had received multiple reports of suspected compromises involving customers' network-attached storage (NAS) devices. "QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users," the company says in an advisory today. Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16. CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, giving it maximum priority.
QNAP's NAS devices are specialized computers with built-in storage that allow users to store, access, and share files across a network. They are typically used to back up computers and store media files.
