QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later.
Technical scope
Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process.
The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation.
Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again.
Compromise assessment
Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised.
This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise.
Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st.
Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure.
Secure reinstallation
For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder.
Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.
Read the original article: