Science & Tech · Cybersecurity · 1 hr ago
Hackers exploit Plex flaws on QNAP network storage devices
Attackers are exploiting Plex Media Server flaws on QNAP network storage devices, the Taiwanese company says.
The four vulnerabilities affect Plex, a media server that QNAP users can install from its App Center, but do not affect QNAP’s own operating systems.
The flaws can let attackers run code without a password on exposed servers, and attacks spread after technical details and working example code became public.
QNAP says it has received reports of compromised Plex servers and that no data loss has been confirmed.
Users should update Plex to version 1.43.3 or later; earlier versions are vulnerable.
Internet-accessible servers may already be compromised, so QNAP advises removing and reinstalling Plex, checking for signs of intrusion, and changing Plex and NAS passwords.
Users who need remote access should use a VPN, and QNAP has published a guide to help them respond.
Attackers are exploiting a chain of four Plex Media Server vulnerabilities to compromise Plex servers on QNAP network storage devices.
The flaws can allow attackers to execute code without valid credentials and affect Plex Media Server, not QNAP’s QTS or QuTS hero operating systems.
QNAP advises users to update Plex Media Server to version 1.43.3 or later and says internet-accessible devices may be compromised.
For potentially compromised devices, QNAP recommends reinstalling Plex and changing Plex and NAS passwords.
SecurityWeek says the flaws were patched in summer 2026, while Heise says they became known in early September.
- Who
- Attackers are targeting users running Plex Media Server on QNAP NAS devices.
- What
- They are exploiting a chain of four vulnerabilities to execute code on exposed servers.
- When
- Widespread exploitation began in mid-October, according to SecurityWeek. Heise says attacks were reported in October.
- Where
- Plex Media Server applications on QNAP NAS devices.
- Why
- The vulnerabilities allow attackers to execute code without valid credentials. Attackers have reportedly used compromised servers to run crypto-miners and proxy software.
This story does not have two clearly opposing sides.
SecurityWeek says the four Plex Media Server vulnerabilities were patched.
Heise says the vulnerabilities became known.
Heise says the first attacks were reported.
SecurityWeek says widespread exploitation began after technical details and proof-of-concept code were published.
- Vulnerabilities
- CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656
- Recommended version
- Plex Media Server 1.43.3 or later
- Affected software
- Plex Media Server on QNAP NAS devices
- Unaffected QNAP systems
- QTS and QuTS hero
- Exposed port
- 32400
3 sources
What people are saying
QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities
The QNAP Technical Support team is assisting affected users and has confirmed that no data loss has occurred.
If you do not need remote access to Plex, disable Plex Remote Access and do not forward port 32400.