# 36,000 Plex Servers Are Sitting Ducks — and Their Owners Probably Don't Know It
The scan results are blunt: more than 36,000 Plex Media Server instances publicly reachable on the internet have not been patched against recently disclosed vulnerabilities. That's not a rounding error. That's a stadium full of exposed home servers, each one a potential foothold into someone's home network.
## The Self-Hosting Trap
Plex is the darling of the self-hosted media crowd — the people who rip their Blu-ray collections, run a Raspberry Pi in the closet, and stream to every TV in the house. Setting it up feels empowering. Maintaining it rarely gets the same attention.
The exposure pattern here is almost textbook. A user installs Plex, opens port 32400 through their router so they can watch movies on the road, and then… mostly forgets about it. The software runs in the background, quietly serving media. Updates come eventually, but there's no Patch Tuesday moment, no corporate IT team pushing enforcement, no one checking.
The result is exactly what researchers keep finding: tens of thousands of servers frozen in time, running versions with known flaws, exposed to the entire internet.
## What the Recent Vulnerabilities Actually Enable
Without patching against the current round of disclosed flaws, Plex servers are vulnerable to attack paths that go well beyond someone stealing your movie library. The most serious classes of vulnerability found in media server software — Plex included — typically involve:
Unauthenticated access or authentication bypass. Plex has historically had issues where improperly configured servers leak content or metadata without requiring credentials. Some flaws have gone further, allowing attackers to enumerate users or sessions.
Remote code execution via media processing. This is the nastier category. Media servers ingest and transcode files, which means they run complex, often years-old parsing libraries against attacker-controlled content. A maliciously crafted video file or subtitle file becomes a weapon. Plex's 2020 RCE vulnerability (CVE-2020-5741) followed exactly this logic — an authenticated attacker with upload access could execute arbitrary Python scripts.
Pivot into the local network. This is the real prize. Most Plex servers aren't isolated. They sit on home networks alongside NAS drives, smart home hubs, other IoT devices, and in some cases corporate VPN endpoints. Compromise the Plex box, and you're inside the perimeter.
## The Breach Shadow Still Hanging Over Plex
It's worth remembering that Plex isn't approaching this moment with a clean slate. In August 2022, the company disclosed a data breach affecting roughly 15 million user accounts — one of the more embarrassing incidents in self-hosted software history, partly because Plex had stored passwords in a way that required a mandatory reset and partly because the notification arrived via email that many users initially dismissed as phishing.
That breach didn't involve the kind of server-level exploitation described here. But it established something important about the Plex user base's security posture: a significant portion of these installations belong to people who aren't treating them as infrastructure requiring active security hygiene. They're entertainment appliances.
Attackers know this.
## 36,000 Is Probably an Undercount
Shodan and similar scanning tools find what they're looking for, but they don't find everything. Port obfuscation, ISP-level filtering, and dynamic IP addresses all mean the real number of unpatched Plex instances is likely higher. What the scan definitively shows is a lower bound — at minimum, 36,000 servers are reachable, identified, and vulnerable.
For anyone running opportunistic scans looking for easy initial access, that's a gift list.
## What You Should Do Right Now
If you run a Plex Media Server exposed to the internet:
---
## HackWire Analysis
The Plex exposure story fits a pattern that repeats every few years with different software: a beloved self-hosted application accumulates users who love it too much to abandon it and trust it too much to patch it. We saw the same dynamic play out with Emby, with OpenMediaVault, with various NAS firmware versions that sat at 1.2 million unpatched installs for years.
What makes Plex specifically interesting right now is the timing. The self-hosted media server ecosystem is larger than it's ever been, partly driven by the streaming wars fragmenting content across a dozen subscription services. People who cut cable and subscribed to Netflix in 2015 are now running their own media libraries out of frustration. That wave of new self-hosters brought enthusiasm but not always operational security.
The critical thing other coverage is missing here: these aren't just individual home user risks. A growing number of Plex users are running their servers on the same hardware — or the same home network — as remote work infrastructure. Post-pandemic, the line between home network and corporate network got very blurry for a lot of people. A compromised Plex instance on a network where someone VPNs into corporate systems is not a home problem. It's a supply chain problem at the endpoint level.
Security teams at organizations that allow remote work should be asking: do our employees run self-hosted media servers? Are those servers on the same network as their work devices? The answer to both questions is almost certainly yes, and nobody has an inventory.
The fix is straightforward. Patch, segment, or eliminate the exposure. The vulnerability itself isn't particularly exotic — the exposure count is what makes this significant. Thirty-six thousand is a number that says the attackers don't need zero-days. They just need patience and Shodan.
— HackWire Editorial
---
## Related Coverage