Threat watch / Vulnerability
Plex2Shell: four chained Plex flaws used to take over media servers and NAS
Four Plex Media Server flaws chain into remote code execution without a login. Plex says they are being "actively and widely exploited" to run crypto miners and proxy software, and QNAP says some customers' NAS were compromised this way. The fix is Plex Media Server 1.43.3.10861 or later.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Plex Media Server, QNAP
- How it happened
- Plex says the four bugs, chained together, let "an unauthenticated remote attacker run code with the privileges of the Plex Media Server process". Servers reachable from the internet on version 1.43.2 or earlier are exposed.[1] Checked 8 Nov 2026
- What was stolen
- Plex says compromised servers "have been used to run cryptocurrency miners and proxy software". No data theft has been reported, but Plex warns that anything the Plex service account can reach, such as mounted shares and stored credentials, may be exposed.[1] Checked 8 Nov 2026
- Who was impacted
- Owners of Plex Media Server 1.43.2 or earlier, including QNAP NAS users. QNAP says it "has received reports from some users" whose Plex server appears compromised. No count of affected servers is public.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Timeline
- Researcher Zach Main publishes the full technical details of the Plex2Shell flaws, according to BleepingComputer. Version 1.43.3.10861, which fixes them, had shipped on August 4. [3]
- Reports of Plex2Shell being exploited in the wild start to emerge, according to BleepingComputer. [3]
- CISA adds all four flaws to its Known Exploited Vulnerabilities catalog and gives U.S. federal agencies three days to upgrade, according to BleepingComputer. [2][3]
- QNAP publishes a notice: some users report that Plex on their NAS appears compromised through Plex2Shell. QNAP says its own systems (QTS, QuTS hero) are not affected and points to Plex 1.43.3.10861 in its App Center. [2][4]
- Plex says the flaws are "actively and widely exploited". It advises any owner whose server was reachable from the internet on an older version to "assume it may be compromised", rebuild from a clean install, sign out all devices and change the Plex password. [1]