36,000 Plex Media Servers remain unpatched against undisclosed flaws

Affected Systems

Plex Media Server v1.43.2 and earlier, Plex Desktop prior to v1.115.0. Over 36,000 internet-exposed instances confirmed vulnerable as of September 2026. Affects self-hosted and NAS-based deployments.

Exploitation Status

No active exploitation reported. CVE IDs not yet assigned, limiting visibility. Plex issued rare email warning to customers. Risk of patch reverse-engineering increases daily. Historical precedent: CVE-2020-5741 was exploited in LastPass breach.

Business Impact

Internet-exposed media servers vulnerable to undisclosed flaws. Plex has not published technical details, but urgency of email notification suggests high-severity issues. Attackers can reverse-engineer patches to develop exploits. Historical Plex vulnerabilities enabled credential theft (CVE-2025-34158) and remote code execution (CVE-2020-5741). Compromised servers may provide pivot points into internal networks.

Urgency

🟠 Within 24 hours

Recommended Actions

• Upgrade all Plex Media Server instances to v1.43.3 or later immediately via server management page or plex.tv/downloads
• Update Plex Desktop clients to v1.115.0 or later on all endpoints
• For NAS-hosted Plex servers (QNAP, Synology, etc.), manually install v1.43.3 package if not yet available in vendor package manager
• Identify internet-exposed Plex instances using asset inventory or Shodan/Censys queries and prioritize patching
• Review firewall rules to restrict Plex Media Server access (TCP 32400) to trusted networks or VPN only where feasible