The CVE record says an attacker with any X-Plex-Token value can put a full URL in the protocol parameter, so the server POSTs to the attacker's chosen destination. In the researcher's chain it is the first step. CISA added it to its Known Exploited Vulnerabilities catalog on 20 October 2026.
What it allows
What Does QNAP Say About Plex2Shell on Its NAS Devices?
Update, 10 November 2026. QNAP's own community guidance cites Plex's statement that internet-facing servers left unpatched since the 16 October proof-of-concept have been subject to widespread attacks, with compromised devices used to run cryptocurrency miners and proxy software. QNAP tells NAS owners to treat an exposed, unpatched device as potentially compromised and follow its remediation steps below.
QNAP's own guidance treats a NAS as potentially compromised if Plex was reachable from the Internet on an affected build. It recommends a clean reinstall of Plex, without restoring old Codecs folder contents, then resetting both the Plex and NAS passwords.
QNAP says compromised devices have been used to run cryptocurrency miners and proxy software. It does not say how many devices were affected.
Who is affected
Plex Media Server before build 1.43.3.10861, according to the CVE record. Plex says 1.43.3.10861 and later are not affected.
Plex's post title says 1.43.2 and earlier, while its 19 October update gives the build number as the cutoff. Use the build number. The researcher's README names builds up to 1.43.3.10828 as vulnerable, so an early 1.43.3 build can still be affected.
Plex's update guide covers Windows, macOS, Linux, NAS devices and Docker. Plex says an internet-reachable server older than 1.43.3.10861 should be assumed possibly compromised.
Timeline
- 1 Sep 2026
Plex announces Plex Media Server 1.43.3 as a security release and says CVEs have been requested.
- 23 Sep 2026
The CVE record is published, with CISA as the CVE numbering authority.
- 16 Oct 2026
A public proof of concept is released, according to Plex.
- 19 Oct 2026
Plex publishes the CVE details and says the flaws are being actively and widely exploited.
- 20 Oct 2026
CISA adds the CVE to the Known Exploited Vulnerabilities catalog.
- 3 Nov 2026
The CISA due date for US federal agencies.
- 6 Nov 2026
QNAP's community guidance cites Plex's statement on widespread attacks on unpatched internet-facing servers and tells NAS owners to treat an exposed device as potentially compromised.
What to do
-
Check your version
Open Plex Web, go to Settings, then General, and read the version. Anything older than 1.43.3.10861 is affected. Compare all four numbers of the build, not only 1.43.3.
-
Update now
Install Plex Media Server 1.43.3.10861 or later. On a NAS the package manager may be behind, so Plex says to download the package from its Downloads page and install it by hand.
-
Cut exposure
If you do not need remote access, turn it off under Settings, then Remote Access. Plex also advises against forwarding port 32400 directly unless you need it.
-
Do not test the endpoint yourself
Do not send requests to /player/timeline to see whether a server is vulnerable. Read the version in Plex Web instead. Then look for unfamiliar processes started by Plex Media Server and for outbound connections to proxystream.st, which Plex lists as a sign of compromise.
-
Rebuild if you cannot rule out a compromise
Plex advises a clean installation instead of reusing the old data directory. Sign out of all devices in your Plex account, change the password, and treat anything the Plex service account could reach as exposed.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Is CVE-2026-96652 being exploited?
Plex says the flaws in this chain are being actively and widely exploited, and CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities catalog on 20 October 2026. CISA lists use in ransomware campaigns as unknown.
Which Plex Media Server version fixes it?
Plex Media Server 1.43.3.10861 and later. Check Settings, then General, in Plex Web, and compare all four numbers of the build.
Do I need to turn off remote access?
Plex advises turning off Remote Access if you do not need it and not forwarding port 32400 directly unless you need it. Updating is still required.
Is CVE-2026-96652 unauthenticated?
Plex calls it unauthenticated. The CVE record says any X-Plex-Token value works, so an attacker does not need a valid account or a valid token.
Why is the CVSS score only 4.3?
Alone, the flaw only lets the server send a request, and the score counts low impact. The danger comes from chaining it with the other three CVEs, which the researcher rates as 9.8 together.
Are QNAP NAS devices affected by Plex2Shell?
QNAP NAS devices that run Plex Media Server are affected like any other host; QNAP's own guidance tells owners to treat an exposed, unpatched device as potentially compromised. QNAP says QTS and QuTS hero themselves are not affected; only Plex Media Server is.
Sources
- Important security update for Plex Media Server v1.43.2 and earlierPlex
- Known Exploited Vulnerabilities catalogCISA
- CVE-2026-96652CVE Program
- CVE-2026-96652NVD
- CWE-918: Server-Side Request Forgery (SSRF)MITRE
- Plex2Shell: Unauthenticated RCE in Plex Media Serverzmain.info (researcher)
- Plex2Shell: Check and Remediation FAQ for QNAP NAS UsersQNAP
