Plex has released patches for several undisclosed security flaws and is urging users to upgrade immediately. The fixes are included in Plex Media Server version 1.43.3 and Plex Desktop 1.115.0. While the company has not provided detailed information about the vulnerabilities, it has requested CVE identifiers to track them. Plex recommends that all server owners and desktop users install the latest versions without delay. If your server is hosted on a NAS and the update isn’t available through its package manager, you’ll need to install the new package manually.
Background on Plex’s Historical Security Risks
Plex isn’t new to serious security issues. In August 2025, a high-severity flaw (CVE-2025-34158) was discovered. An authentication bug in the “/myplex/account” endpoint allowed non-owner or lower-privileged users to access the server owner’s account details, including admin tokens. That flaw enabled an attacker, via a separate “/api/resources” endpoint, to discover other servers linked to the owner—posing a significant exposure risk.
Data from Censys reveals that over 360,000 devices currently expose the Plex Media Server web interface to the internet, though not all are vulnerable. The risk increases if servers are unpatched.
Past Exploits and Related Incidents
Plex servers have been targeted before. In February 2021, a vulnerability allowed attackers to leverage UDP traffic to launch large-scale denial-of-service (DoS) attacks via exposed Plex servers. The patch issued restricted responses to LAN traffic only, preventing exploitation over the internet.
One of the most high-profile incidents tied to Plex’s vulnerabilities occurred during the August 2022 LastPass breach. Attackers exploited a Plex-related flaw (CVE-2020-5741) to drop keylogger malware on an employee’s home system, eventually gaining access through there.
This latest update underscores Plex’s ongoing battle to stay ahead of security threats. Users running either Media Server 1.43.3 or Desktop 1.115.0 (or newer) are urged to install them as soon as possible.
What this means & what to watch for: Plex’s frequent vulnerabilities—across authentication, exposed endpoints, and API misuse—highlight how streaming and media services remain lucrative targets. The company’s decision to patch without immediately disclosing details might delay detection by defenders, but speed here matters. Users should regularly monitor their systems, check for updates manually when needed, and ensure internet-exposed servers are properly secured. Going forward, CVE listings will help visibility, and watching whether threat actors quickly exploit the newly patched flaws will be critical.
