Synology NAS with Plex Media Server: update the Plex package

If your Synology NAS runs Plex Media Server, update the Plex package in Package Center now. Synology's advisory Synology-SA-26:17 of 8 November 2026 covers four Plex flaws it calls Plex2Shell, rated Important, with fixed packages for DSM 7.2.1 to 7.4. A NAS without Plex is not affected.

What is the problem?

Synology says Plex Media Server versions before 1.43.3.10861 have four weaknesses. The most serious one lets a person with a Plex admin login place files on the NAS that can then run as programs. Synology scores this one 7.2 out of 10. Two others let a logged-in Plex user make the NAS send requests to other addresses, including machines on your own network. The fourth lets an attacker call functions of other Plex plugins through a search request.

Synology lists no workaround, so updating the package is the only fix.

Which version do I need?

According to Synology, update Plex Media Server to at least these builds:

What to do

1. Log in to DSM as an administrator and open Package Center.
2. Look under Installed for Plex Media Server. If it shows Update, click it and wait for it to finish.
3. Check the version number against the table above.
4. If nobody uses Plex any more, stop it or uninstall it. Fewer packages means fewer things to update.
5. Review the Plex admin and user accounts. Remove old accounts and give admin rights only to people who need them.
6. Do not open Plex or DSM ports to the internet on your office router unless you really need remote access. Use the vendor's secure remote access options or a VPN instead.
7. While you are in DSM, install any waiting DSM update as well. Our earlier note on Synology ransomware attacks on old DSM explains why.

How SyncTech can help

Not sure what runs on your office NAS, or who still has a login? Our help centre shows how to reach our support team for a check of your office IT.

Source and credit

We are sharing this security advisory from Synology. This summary is written by Synctech in our own words.

• Synology-SA-26:17 Plex Media Server (Plex2Shell), Synology, 8 November 2026: https://www.synology.com/en-global/security/advisory/Synology_SA_26_17 Retrieved 9 November 2026. Synology, DSM and Plex are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.