Over 36,000 exposed Plex servers vulnerable to recent flaws

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against multiple security vulnerabilities disclosed by Plex in September 2026. Affected versions include v1.43.2 and earlier. Plex has released version 1.43.3 to address these issues, but CVE identifiers have not yet been assigned, limiting visibility and response within the security community. Attackers could reverse-engineer the patches to develop exploits, especially given the history of prior vulnerabilities in Plex being exploited for credential theft and remote code execution.

AI-extracted · verify before operational use