Security AlertHigh
QNAP warns Plex2Shell attacks may hit NAS devices
Nov 6, 2026 · Summarized by Fundy Tech from BleepingComputer
The 30-second version
QNAP says hackers are exploiting Plex2Shell flaws in Plex Media Server and may have compromised some NAS devices. The company urges users to update now and check for signs of compromise.
Key points
- The Plex2Shell chain includes four Plex Media Server CVEs.
- QNAP says QTS, QuTS hero and other QNAP systems are not affected.
- CISA added the flaws to its exploit catalog on October 20, 2026.
Why it matters
If your business or household uses a QNAP NAS with Plex, your stored files and media could be at risk. Updating alone may not remove attacker payloads, so a clean reinstall and credential reset may be needed.
Who’s affected: QNAP NAS devices running vulnerable Plex Media Server
What to do
- Update Plex Media Server through the QNAP App Center.
- Check QNAP’s compromise indicators.
- Disable remote Plex access if you do not need it.
- Consider a clean reinstall and reset Plex and NAS credentials.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.