Over 36,000 Plex Media Servers Remain Unpatched, Leaving Them Open to Attack

Security researchers have identified more than 36,000 Plex Media Server instances that are publicly reachable and have not applied recent security patches, exposing them to a range of known vulnerabilities.

The findings were first disclosed by BleepingComputer, which highlighted that the unpatched servers are susceptible to exploits that could allow attackers to execute arbitrary code, steal credentials, or hijack the streaming service for malicious purposes. Plex, a popular platform for organizing and streaming personal media libraries, has released patches addressing the flaws, but many administrators appear unaware or have not yet updated their installations.

According to the report, the vulnerable servers were discovered through automated scans of the internet that flagged Plex instances lacking the latest software version. The scans focused on ports typically used by Plex, revealing a substantial number of installations that either run outdated software or have misconfigured network settings that expose them to the public.

Experts note that the risk is amplified by the nature of the software: Plex servers often store user credentials, media metadata, and can be configured to grant remote access. If an attacker successfully exploits the vulnerabilities, they could potentially gain control over the server, view private media collections, or use the compromised host as a foothold for broader network intrusion.

Plex has responded by publishing security advisories and urging users to update to the latest version, which incorporates mitigations for the reported bugs. The company also recommends disabling unnecessary remote access features and employing strong, unique passwords for all accounts.

While the exact timeline for when the vulnerabilities were first introduced is not detailed in the public report, the rapid identification of tens of thousands of exposed instances underscores a broader challenge in the consumer‑focused software ecosystem: keeping a dispersed user base current with security updates. Similar patterns have emerged with other home‑server applications, where ease of installation often outweighs rigorous maintenance practices.

Security analysts advise owners of Plex servers to verify their software version, apply any pending updates, and review firewall rules to restrict inbound connections to trusted networks only. For organizations that host Plex as part of internal media distribution, incorporating the server into regular vulnerability management workflows is essential to avoid inadvertent exposure.

The discovery serves as a reminder that even widely used entertainment platforms can become attack vectors if left unpatched. As the internet continues to be scanned for vulnerable services, timely remediation remains the most effective defense against exploitation.