Affected Systems
Plex Media Server versions prior to 1.43.3.10861 running on QNAP NAS devices (QTS, QuTS hero). Four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656. QTS and QuTS hero operating systems themselves are not vulnerable.
Exploitation Status
Active exploitation confirmed. QNAP reports multiple customer compromises. CISA added all four CVEs to KEV catalog on October 20, 2026. Exploitation began shortly after public disclosure of technical details on October 16, 2026.
Business Impact
Attackers gain full control of exposed QNAP NAS devices running vulnerable Plex Media Server. Compromised devices may contain backup data, media files, and sensitive personal or business content. Updating Plex does not remove attacker payloads already installed. Organizations using QNAP NAS for backups or file sharing face data theft, ransomware deployment, and lateral movement risk. Over 36,000 Plex servers were publicly exposed at time of disclosure.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update Plex Media Server to version 1.43.3.10861 or later via QNAP App Center on all QNAP NAS devices
- Assume compromise if Plex was internet-exposed and vulnerable: check QNAP security bulletin for indicators of compromise, perform clean OS reinstall (QTS or QuTS hero), reset all Plex and NAS credentials
- Disable remote Plex access features and stop forwarding port 32400 if remote access is not required; use VPN for remote access if needed
- Submit logs to QNAP technical support portal for compromise investigation if breach is suspected
- Audit network for other QNAP NAS devices running Plex and prioritize patching or isolation of internet-facing instances