Per Bleeping Computer, over 36,000 Plex Media Server instances exposed online are still unpatched and vulnerable to potential attacks, according to a warning from the nonprofit security organization Shadowserver. Plex had previously urged users to secure their media servers immediately against security issues that have yet to be assigned CVE identifiers.The unpatched Plex Media Server instances are running versions 1.43.2 and earlier. Shadowserver reported scanning and identifying these unpatched servers daily since September 4, 2026, in response to a Plex advisory. The lack of CVEs makes these vulnerabilities difficult for the security community to track and address effectively. Plex has released version 1.43.3 of its Media Server and version 1.115.0 of its Desktop client to address these security concerns, recommending all users update immediately.This situation follows previous warnings from Plex regarding security vulnerabilities, including a high-severity flaw (CVE-2025-34158) that could be exploited to steal server owner credentials and a remote code execution flaw (CVE-2020-5741) that was actively exploited and potentially used in the LastPass breach.Bleeping Computer
Source: Vulnerability Management
Over 36,000 Plex media servers remain unpatched against security vulnerabilities
Related Events
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds