Security researchers have discovered more than 36,000 publicly accessible Plex media server instances worldwide that remain vulnerable to multiple security flaws patched in recent updates.
Plex patched the vulnerabilities in Media Server version 1.43.3 and Plex Desktop version 1.115.0, released in early September. The company warned that attackers can exploit previous versions through multiple undisclosed vulnerabilities, but has not yet provided details on the number of flaws, their CVSS severity ratings, or what an attacker could achieve after successful exploitation. CVE numbers have been requested but not yet assigned.
Shadowserver Foundation scans confirmed that 36,000 instances remain publicly reachable and exploitable. The United States accounts for 16,000 of these systems; Germany follows with approximately 1,550. Affected platforms include Linux, macOS, Windows, and NAS devices.
Plex noted that patched packages may not yet be available for all package managers, requiring manual installation in some cases. The company urged administrators to update immediately and not delay patching.
No active exploitation has been reported so far, but the combination of publicly accessible instances, undisclosed vulnerability details, and the lag in patch deployment creates a window of risk. Plex media servers commonly handle personal media libraries and are often exposed to the internet for remote access, making unpatched instances attractive targets.
