Plex this week urged customers to update both desktop clients and media servers immediately after disclosing multiple security vulnerabilities. The company said the flaws are known to affect Plex Media Server v1.43.2 and earlier, and it has released a server update (1.43.3) and a Desktop client update (1.115.0) to address the problems.
What Plex told users and how to update
Plex has both posted the updates and emailed customers running affected versions, asking them to upgrade "as soon as possible." The company noted that the server update — Plex Media Server 1.43.3 — was released on May 19, and the Desktop client update — Plex Desktop 1.115.0 — was released on August 13. Plex advised users that the patched packages are available from the official downloads page or from the server management page, and it warned that updated packages may not yet appear in some NAS package managers; in that case, Plex said a manual install is an option.
Plex also said CVE identifiers for the newly reported issues have been requested and that it will post more detailed information once those CVEs are published. In the meantime, the company explicitly recommended that server owners and Desktop users install the new releases to address the security issues.
Which versions and platforms are affected
The company identified Plex Media Server v1.43.2 and earlier as being affected. The advisory did not enumerate specific Desktop builds that are vulnerable, but Plex released Desktop 1.115.0 to address "a number of security issues" and recommended Desktop users update. Plex cautioned that users who run Plex Media Server on NAS devices may need to install updated packages manually if the NAS package manager has not yet published the patched release.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHistorical vulnerabilities and the LastPass connection
The new advisory sits against a record of past, consequential security events tied to Plex. In August 2025, Plex warned users to patch a high-severity vulnerability tracked as CVE-2025-34158 that allows threat actors to steal the server owner's credentials. Two years earlier, in March 2023, CISA flagged a Plex Media Server remote code execution flaw (CVE-2020-5741) as actively exploited; that class of flaw can allow attackers to make the server execute malicious code.
The source material links earlier exploitation to wider damage: attackers used access to steal an engineer's credentials and to compromise the LastPass corporate vault, which the reporting says led to a massive August 2022 data breach after the attackers stole LastPass's database backups. The same month as the CISA notice — March 2023 — Plex notified users of a data breach and warned them to reset passwords after attackers gained access to a database containing emails, usernames, and encrypted credentials.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Apply Plex Media Server 1.43.3 and Plex Desktop 1.115.0 immediately where possible, and plan for manual package installation on NAS systems where the package manager has not yet been updated. Watch the vendor thread for the CVE postings so you can map the issues to detection and response controls once identifiers and technical details are available.
- Enterprises and procurement leaders: Inventory deployments of Plex Media Server and Desktop across user endpoints and shared servers. Coordinate patching timelines and ensure that critical servers are updated first; an enterprise should assume the lack of public technical detail increases the value of prompt patching to reduce exposure.
- End users: Follow Plex's update guidance and install the releases from the official downloads page or the server management page. Plex's advisory specifically warns that attackers could reverse-engineer the patches and develop exploits if details of the vulnerabilities are not disclosed first, creating an immediate window of elevated risk.
Why rapid patching matters now
Plex's request for CVE assignments and its limited public technical detail leave a period during which defenders must act largely on vendor guidance. The advisory underscores a recurring pattern: past Plex vulnerabilities have been exploited to harvest credentials and to enable far-reaching intrusions. The reporting also cites the Blue Report 2026 observation that "overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." Blue Report 2026, the source says, measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder that credential theft and post-compromise activity are where many defenses can fail.
Plex has promised to follow up when CVEs are published. Until then, the company and outside reporting both point to a simple, immediate course: update Plex Media Server to 1.43.3 and Plex Desktop to 1.115.0, and install patched packages manually on NAS devices if necessary. The sequence of prior incidents — credential theft, data exfiltration, and a notified breach — gives weight to Plex's urgency.
