[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkLMXMYhxYv1pRKvH_YwLkM48A-3Baaoja_WJKQPrBX8":3},{"article":4,"iocs":48,"watch_terms":59,"solutions":60,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"19275c65-c684-4190-b236-9bae77aad77b","Plex2Shell Exploited Against QNAP NAS Users","plex2shell-exploited-against-qnap-nas-users-cd9d06","Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices. The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.","Threat actors are actively exploiting a chain of four vulnerabilities, dubbed Plex2Shell, to compromise Plex Media Server applications on QNAP NAS devices. These vulnerabilities, patched earlier this summer, allow for arbitrary code execution without requiring credentials. QNAP is advising users to update Plex Media Server, disable remote access if not needed, and rotate passwords.","Threat actors exploit Plex2Shell vulnerabilities to hack QNAP NAS devices.","https:\u002F\u002Fwww.securityweek.com\u002Fplex2shell-exploited-against-qnap-nas-users\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002FQNAP.jpeg","2026-11-09T13:13:28+00:00","2026-11-09T14:00:22.759199+00:00",8,[17,20,22],{"name":18,"type":19},"Plex Media Server","product",{"name":21,"type":19},"QNAP NAS",{"name":23,"type":24},"QNAP","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,55,57],{"type":50,"value":51,"context":52},"cve","CVE-2026-96652","Part of the Plex2Shell vulnerability chain.",{"type":50,"value":54,"context":52},"CVE-2026-96654",{"type":50,"value":56,"context":52},"CVE-2026-96655",{"type":50,"value":58,"context":52},"CVE-2026-96656",[23,18,21],{"controls":61,"vendors":145},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"slug":92,"name":93,"problem":94,"products":95},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":121,"name":122,"problem":123,"products":124},"patch-management","Automated patch management","Known holes get closed in days, not months.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":121,"product_name":142,"url":143,"description":144},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":158},"plex2shell-chained-vulnerabilities-exploited-on-qnap-nas-devices","Plex2Shell: Chained Vulnerabilities Exploited on QNAP NAS Devices","Threat actors successfully chained four vulnerabilities in Plex Media Server on QNAP NAS devices to achieve unauthenticated remote code execution — despite patches being available for weeks before exploitation began. This highlights the dangerous gap between patch availability and patch deployment, particularly on network-attached storage devices that often run third-party applications with overlooked update cycles. NAS devices are high-value targets because they frequently store sensitive personal and business data and may be directly exposed to the internet. The lack of credential requirements for exploitation means that any internet-facing system running the unpatched software was trivially compromised.",[151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":159,"PCI DSS Requirement 6":160,"NIST SP 800-53 SI-2: Flaw Remediation":161,"OWASP A06:2021 Vulnerable and Outdated Components":162,"CIS Control 7: Continuous Vulnerability Management":163,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":164,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":165},"NIS2 requires entities to implement policies on vulnerability handling and patching as part of their cybersecurity risk management measures; the delayed patching of a critical media server application on internet-exposed NAS devices is a direct failure of this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by protecting them from known vulnerabilities through patching; if any QNAP NAS devices were in scope for card data, the unpatched Plex Media Server would represent a direct violation of this requirement.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; adherence to this control would have mandated rapid application of the available Plex Media Server patches before active exploitation occurred.","Plex Media Server is a third-party component running on QNAP NAS; OWASP A06 warns that failing to track and promptly update such components exposes systems to exactly the kind of chained exploit demonstrated by Plex2Shell.","The Plex2Shell vulnerabilities had patches available before exploitation began; a continuous vulnerability management program with defined remediation SLAs would have ensured timely patching of the QNAP Plex instances before attackers could chain the four flaws.","This control explicitly requires organizations to obtain timely information about technical vulnerabilities in systems they use and take appropriate action, directly addressing the failure to patch Plex Media Server within a safe window after the fixes were released.","The vulnerabilities allowed unauthenticated code execution, and QNAP's own guidance to disable unnecessary remote access aligns with this control's requirement to restrict access to only what is needed, reducing the attack surface exposed to the internet."]