Plex2Shell on QNAP: check your NAS and respond to possible compromise
A Plex server on a QNAP NAS should now be specifically checked: On November 6, 2026, QNAP reported evidence of already compromised devices and confirmed active attacks on the Plex2Shell vulnerabilities. Two questions are crucial: Which version of Plex was running and was it accessible from outside?
Quick take
Plex Media Server 1.43.2 and earlier versions are affected, according to QNAP. Update to at least 1.43.3.10861 or newer and check the version number in Plex Web. If Plex was accessible from the Internet during an affected version or if this is unclear, the update is not sufficient as a cleanup: QNAP recommends a clean reinstallation, a check for signs of compromise and resetting affected credentials. According to QNAP, QTS and QuTS hero themselves are not the target of these Plex vulnerabilities.
Checked: 8 November 2026. This article summarizes the manufacturer's instructions. It is not a substitute for an investigation into a potentially compromised system. If the NAS is important for business or if the findings are uncertain, QNAP support should be involved.
Which devices and versions are meant?
The vulnerabilities lie in Plex Media Server, not the QNAP operating system. QNAP lists Plex 1.43.2 and earlier versions as affected; 1.43.3.10861 or later contains the fix. According to QNAP and Plex, the four vulnerabilities together could allow an unauthenticated attacker to execute code with the privileges of the Plex process. A QNAP NAS without Plex Media Server installed is not affected by this specific incident.
| Findings | Classification | Next step |
|---|---|---|
| No Plex Media Server installed | These Plex vulnerabilities do not affect the installation. | No Plex2Shell action required; Continue general NAS updates. |
| Plex 1.43.2 or older, never accessible from outside | Affected version, but not an Internet exposure case according to QNAP. | Update to at least 1.43.3.10861 in the App Center and then check the version. |
| Affected version was publicly available or exposure was unclear | Possible compromise; An update does not remove installed malicious components. | Follow QNAP instructions for logs, clean install, indicator check and credential change; contact support if necessary. |
Check version and possible exposure
- Open QNAP App Center > My Apps and check the installed Plex version. Then confirm the result in Plex Web under Settings > General.
- Check whether Plex remote access was active during the old version, port 32400 was forwarded in the router, UPnP opened ports automatically, or a myQNAPcloud router configuration made the service accessible.
- If such a path existed or you cannot rule it out, treat the NAS as possibly compromised. An update remains important, but is not the entire reaction.
If Plex was accessible from outside
Follow the QNAP FAQ in the order listed. If you want to ask QNAP to help investigate, back up the Plex Logs folder first before removing the application. Then look out for unknown programs started by the Plex process, unfamiliar files in the Codecs folder, unusual outgoing connections and persistently high processor load without playback. These clues do not individually prove infection; However, a discovery or a compromise that cannot be ruled out should not be considered resolved simply by deleting a suspicious file.
QNAP describes a clean reinstallation and changing Plex and NAS credentials. Also consider credentials and shared folders that the Plex service could access. Change reused passwords on other services too. For important data, consult QNAP Support before making changes that could delete logs or evidence.
Reduce attack surface
If you don't need remote access, turn off Plex Remote Access and remove router forwarding for port 32400; Also check automatic port mappings through UPnP or router configuration. If you need remote access, QNAP lists a VPN as an alternative to direct port forwarding. Also keep QTS or QuTS hero and installed apps up to date. You can find practical NAS and security guides in the TechKompass.
Sources and method
- QNAP security bulletin dated November 6, 2026 – affected versions, confirmed reports and recommended immediate actions.
- QNAP Community: Plex2Shell FAQ for QNAP NAS users – Test steps, exposure routes and cleanup.
- Plex security announcement – CVE mapping, version correction and manufacturer recommendations.
- BleepingComputer, November 6, 2026 – independent classification of the incidents reported by QNAP.
A suitable official video with a verified step sequence was not found during the research. Because QNAP's written FAQ already details the specific and potentially consequential steps, no video was forced or embedded.
Author: TechDesk PE Digital.Networks.