Plex Urges Immediate Update After Patching Undisclosed Vulnerabilities

Plex has urged users of its media server to update to the latest versions without delay following the release of a patch that closes several vulnerabilities at once. The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0.

The nature of the resolved issues, however, has not been disclosed: Plex said only that CVE identifiers have already been requested for them. “We recommend that all server owners and Desktop users update to the latest version as soon as possible,” the announcement states.

Separately, the company warned NAS owners that the update may not appear immediately in the built-in package manager of such devices, so the package can be installed manually.

Why this matters

Plex Media Server regularly draws the attention of attackers, and its web interface is widely accessible over the network. According to Censys, more than 360,000 devices expose this interface externally — though, as noted, far from all of them are vulnerable.

The latest call to update comes against the backdrop of last year’s story. In August 2025, Plex closed a high-severity vulnerability (CVE-2025-34158, CVSS score 8.5): the “/myplex/account” endpoint mistakenly exposed the server owner’s account data, including the administrative access token, even when accessed by an ordinary authorized user with fewer privileges. A subsequent request to “/api/resources” made it possible to see other servers available to that owner — so a chain of two calls turned into a tool for reconnaissance of the victim’s entire infrastructure.

Not the first time

Plex vulnerabilities are used in attacks from time to time. In February 2021, a patch was released against a vulnerability that allowed a server to be forced to “reflect” UDP packets and thereby amplify a DoS attack on a third-party host; the fix limited the server’s responses to the local network only.

The most high-profile episode is tied to the LastPass breach in August 2022. Back then, the attackers compromised an employee’s home computer specifically through a Plex Media Server vulnerability (CVE-2020-5741, CVSS 7.2) and installed a keylogger — this chain is what led to the subsequent intrusion.

Against this backdrop, the advice to update without waiting for the details of the vulnerabilities looks quite reasonable.

Source: The Hacker News