Over 36,000 Exposed Plex Servers Remain Unpatched Against Security Vulnerabilities
A staggering 36,000+ Plex Media servers exposed online remain vulnerable to attacks due to unpatched security vulnerabilities. The affected servers are running on outdated versions of Plex Media Server v1.43.2 and earlier, leaving their users open to potential cyber threats.
Plex issued a warning last week urging its users to secure their media servers immediately against multiple security issues that still lack official CVE (Common Vulnerabilities and Exposures) IDs for tracking purposes. The company has since recommended that affected users update their Plex Media Server installations to version 1.43.3, released on May 19, and their Plex Desktop clients to 1.115.0, released on August 13.
The nonprofit security organization Shadowserver, which has been scanning and reporting unpatched versions of Plex Media Server daily in response to the advisory issued by Plex, recently revealed that over 36,000 instances are still unpatched. According to Shadowserver, these vulnerabilities are invisible to the security community due to the lack of CVEs, making an effective response challenging.
This is not the first time Plex has faced a critical security issue. In August 2025, the company warned users about a high-severity vulnerability (CVE-2025-34158) that can be exploited to steal server owner credentials. Additionally, in 2020, a remote code execution flaw (CVE-2020-5741) was flagged by CISA as actively exploited, allowing attackers to execute malicious code on the server.
The lack of patching for these vulnerabilities is alarming, especially considering the potential consequences of an attack. As threat actors can use valid credentials to bypass security measures, only 37% of their actions are blocked once they gain initial access. This highlights the importance of timely patching and keeping software up-to-date.
Plex users running affected versions should take immediate action by updating their servers and clients as recommended by Plex. It’s essential for users to follow best practices and prioritize security to prevent potential attacks. As demonstrated by past incidents, neglecting patching can lead to severe consequences, including data breaches and compromised systems. In this case, the urgency of patching is further emphasized by the lack of CVEs, making it crucial for affected users to act promptly.
To protect yourself from potential cyber threats, make sure to keep your software up-to-date, especially if you’re running a media server like Plex. Regularly check for updates and follow the recommended steps to secure your system. By doing so, you can significantly reduce the risk of an attack and prevent potential data breaches.
Source: Bleeping Computer — 2026-09-09