Vulnerabilities · 3h ago

Plex2Shell puts QNAP NAS storage at risk

QNAP says attackers are exploiting the four-flaw Plex2Shell chain to breach NAS devices running Plex Media Server. The company urges users to update Plex through the QNAP App Center.

One Plex flaw lets a request to the media server make the NAS contact addresses it can reach, including systems inside or outside its network. That makes the NAS itself a way into reachable systems, not just a host for media playback.

For organizations using a QNAP NAS as shared storage, a breached Plex service puts the storage host and its network position at risk. QNAP’s update closes the cited route, but the reporting does not establish whether devices compromised beforehand are clean.

CVE-2026-96652

NVD KEV

Known exploited · CISA KEV

CVSS 4.3 MEDIUM: plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. EPSS 12% (96th percentile).

CISA federal remediation date Nov 3 · date passed

CVE-2026-96655

NVD KEV

Known exploited · CISA KEV

CVSS 4.3 MEDIUM: plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external… EPSS 11% (96th percentile).

CISA federal remediation date Nov 3 · date passed

CVE-2026-96654

NVD KEV

Known exploited · CISA KEV

CVSS 6.5 MEDIUM: plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an… EPSS 2% (80th percentile), up from 0.5%.

CISA federal remediation date Oct 23 · date passed

CVE-2026-96656

NVD KEV

Known exploited · CISA KEV

CVSS 7.2 HIGH: plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. EPSS 2% (78th percentile).

CISA federal remediation date Oct 23 · date passed

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-11-06

Editions

Related stories