# Plex2Shell: update Plex and investigate servers exposed to the internet Canonical: https://www.oktsec.com/radar/plex-media-server-plex2shell Publisher: Oktsec Language: en Published: 2026-11-08T11:20:02Z Updated: 2026-11-08T11:20:02Z Record reviewed: 2026-11-08T11:20:02Z Latest evidence check: 2026-11-08T11:20:02Z Disclosed: 2026-09-01 Plex confirms active exploitation of four vulnerabilities that allow remote code execution without authentication. QNAP reports possible compromises of Plex installations on NAS devices; the flaws are in Plex Media Server, not QTS or QuTS hero. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Plex confirms attacks against exposed unpatched servers. The chain permits code execution with the service account privileges without credentials. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Plex - Products: Plex Media Server - CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 ## Technical overview Plex2Shell chains request forgery, access to internal functions, disclosure of an administrative token and a file write into remote code execution. Execution uses the Plex process privileges; root access must not be assumed on every installation. Plex disclosed the security update on September 1 and confirmed attacks on October 19. QNAP issued its NAS notice on November 6. These are earlier disclosures newly covered in Radar, not evidence that the attacks began today. QNAP identifies Plex Media Server as the affected application and reports user submissions of possible compromise. Its operating systems QTS and QuTS hero are not themselves affected by these four flaws. The corrected Plex package is available in QNAP App Center. Separate patching from recovery. An exposed vulnerable installation may retain malicious software after an update. Follow the vendor guidance for investigation, clean installation and credential recovery, including resources accessible to the service account. ## Recommended response Update Plex Media Server to 1.43.3.10861 or later and restrict remote access. Investigate previously exposed installations; updating alone does not remove a prior compromise. Relevant to: Administrators of Plex Media Server on NAS devices, servers and virtual machines, especially installations reachable from the internet. ## CVE attribution - CVE-2026-96652: Plex — Plex Media Server. [Source](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3) - CVE-2026-96654: Plex — Plex Media Server. [Source](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3) - CVE-2026-96655: Plex — Plex Media Server. [Source](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3) - CVE-2026-96656: Plex — Plex Media Server. [Source](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3) ## Affected systems and fixes ### Plex Media Server Affected: 1.43.2 and earlier; verify the complete installed build against the corrected release. Fixed release / action: 1.43.3.10861 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.04 Checked: 2026-11-05T12:14:16.442Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-07T13:37:50.242Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-07T13:37:50.242Z. ## Response checklist 1. **Identify version and prior exposure** — Record the complete Plex version and whether remote access, port forwarding or automatic router configuration exposed the service before the update. 2. **Update and limit access** — Install the corrected Plex release and verify the running version. Disable unnecessary remote access and port forwarding; QNAP recommends VPN access when remote connectivity is needed. 3. **Investigate possible compromise** — Preserve logs and review unexpected processes, Codec files and outbound connections. Follow the platform recovery guidance if compromise is suspected or cannot be ruled out. 4. **Recover affected access** — Follow Plex and QNAP recovery instructions for a clean reinstall and account recovery. Review reachable shares and stored credentials, and revoke affected sessions. ## Relevance to AI environments Review shared storage and credentials accessible to the Plex service account, including resources also used by automation. ## Sources - [Plex: security update and exploitation confirmation](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/3) — Plex; Vendor notice; checked 2026-11-08T11:16:35Z - [Plex: original security update, September 1](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/1) — Plex; Vendor notice; checked 2026-11-08T11:16:35Z - [QNAP: Plex2Shell scope and recovery guidance](https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately) — QNAP; Vendor notice; checked 2026-11-08T11:16:35Z ## Editorial record - 2026-11-08T11:20:02Z: Added Plex confirmation of active exploitation and QNAP guidance on updating and investigating potentially compromised installations. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/plex-media-server-plex2shell) · [Build a response plan](https://www.oktsec.com/radar/plex-media-server-plex2shell#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=plex-media-server-plex2shell&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=plex-media-server-plex2shell&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.