Plex has issued an urgent security advisory, urging users to immediately update their Plex Media Server and Plex Desktop client installations to address multiple undisclosed security vulnerabilities. While specific details and CVE IDs for these new flaws are currently unavailable, the company’s proactive communication, including direct email notifications to affected users, underscores the severity of the issues.
Urgent Plex Security Advisory
According to BleepingComputer, Plex released updates for its media server and desktop client this week, highlighting the need for immediate patching. The company explicitly stated, “We recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible.” This direct communication is notable, as Plex rarely emails customers specifically about vulnerability updates unless the risks are significant.
The affected versions include Plex Media Server v1.43.2 and earlier, and the Plex Desktop client v1.115.0 and earlier. Users running these versions are advised to update without delay to secure their systems. Plex has confirmed that CVEs for these vulnerabilities have been requested and will be published once available. The current lack of public details means that defenders cannot yet assess specific risks beyond the vendor’s urgent recommendation. However, the standard advice applies: patching before exploit details emerge is crucial to prevent attackers from reverse-engineering the updates to develop active exploits.
Context of Past Plex Vulnerabilities and Security Incidents
This urgent advisory comes against a backdrop of previous significant security incidents and vulnerabilities affecting Plex products, providing critical context for the current warning.
- Credential Theft: In a past incident, Plex warned users to patch a high-severity vulnerability, CVE-2025-34158, which allowed threat actors to steal server owner credentials. The source indicates this warning occurred in “August 2025,” which appears to be a forward-dated error in the reporting, but the nature of the vulnerability itself highlights the sensitive data Plex servers can handle.
- Remote Code Execution (RCE): The U.S. Cybersecurity and Infrastructure Security Agency (CISA) previously flagged a Plex Media Server remote code execution flaw, CVE-2020-5741, as actively exploited. This vulnerability permitted attackers to execute malicious code on affected servers. CISA’s alert on CVE-2020-5741 in March 2023 was likely linked to the LastPass data breach disclosure. In that incident, attackers exploited a third-party media software RCE bug on a senior DevOps engineer’s computer to install keylogging malware, ultimately leading to the compromise of LastPass’s corporate vault. This historical context underscores the potential impact of RCE vulnerabilities in media server software and emphasizes the importance of promptly mitigating Plex security flaws.
- Data Breach: In August 2022, Plex itself notified users of a data breach, advising password resets after attackers accessed a database containing emails, usernames, and encrypted credentials.
These past events illustrate the severe consequences that can arise from unpatched vulnerabilities in Plex environments, ranging from direct system compromise to credential theft and wider data breaches.
Actionable Recommendations: Plex Media Server 1.43.3 Update
Security professionals and Plex users must prioritize these updates. The most critical action is to apply the patches immediately to protect against potential exploitation of the newly addressed vulnerabilities.
- Update Plex Media Server: Users should update to Plex Media Server version 1.43.3 or later. This version was released on May 19.
- Update Plex Desktop Client: Users of the Plex Desktop client should update to version 1.115.0 or later, released on August 13.
- NAS Device Considerations: For users running Plex Media Server on Network Attached Storage (NAS) devices, the updated version may not yet be available via the device’s package manager. In such cases, Plex advises users to install the package manually from the official Plex downloads page or the server management page.
- Monitor Advisories: Continue to monitor official Plex channels for further details, including the eventual publication of CVE IDs and more in-depth technical descriptions of the Plex Desktop client 1.115.0 vulnerabilities. Understanding the specific nature of these flaws will aid in future threat hunting and defense strategies.
Implementing these updates is essential to proactively mitigate the risks associated with these undisclosed security issues and prevent potential exploitation that could lead to unauthorized access, data compromise, or even remote code execution.
Related: SAP NetWeaver & Commerce Cloud: Urgent Critical Patches Released, CISA BOD 26-04: Prioritizing KEV Catalog Vulnerability Patching