Attackers are actively exploiting the Plex2Shell vulnerability chain to compromise internet-exposed NAS devices
QNAP urges immediate updates, as older Plex Media Server versions allow remote code execution and full device takeover
Systems exposed before patching may already be compromised and require credential resets and full remediation
QNAP has issued a security advisory warning users to install the latest version of the Plex Media Server app on their Network Attached Storage (NAS) devices. It says older versions are being actively abused in the wild using the dreaded Plex2Shell vulnerability chain. “Plex has confirmed that these vulnerabilities are being actively and widely exploited,” the company said in the advisory. “QNAP urges all users running Plex Media Server on a QNAP NAS to update immediately and to review their devices as described below. What is a QNAP NAS and what does it have to do with a flaw in Plex? A Network Attached Storage device is a dedicated system allowing users to store, back up, and share files across a network. Essentially it’s a series of hard drives connected to a local network for easy access. Consumers and businesses alike often use it as an alternative to subscription-based cloud storage models, and sometimes even to stream audio and video files. One popular way to do that is via a software application called Plex Media Server, which allows users to organize and stream their personal collection of movies, TV shows, music, and other multimedia content. By installing Plex on their NAS, and a compatible player app on a smartphone and similar device, users can access their media libraries over a local network or remotely via the internet. This last part – via the internet – is where trouble was recently found. Earlier in November 2026, Plex disclosed having fixed four vulnerabilities in Media Server versions 1. 43. 2 and older: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Separately, these four are relatively dangerous. Chained together, they allow unauthenticated threat actors to execute arbitrary code with the highest privileges, remotely…