Plex urges immediate patching of undisclosed flaws in Media Server

Affected Systems

Plex Media Server v1.43.2 and earlier, Plex Desktop client versions prior to 1.115.0. Affects all platforms including Windows, macOS, Linux, and NAS devices running Plex.

Exploitation Status

No active exploitation reported. CVE IDs not yet assigned. Technical details withheld by vendor, but patches are public (released May 19 and August 13, 2026), creating risk of reverse-engineering exploits.

Business Impact

Plex rarely emails users about security updates, indicating high severity. Nature of vulnerabilities unknown, but Plex's history includes credential theft (CVE-2025-34158) and RCE flaws (CVE-2020-5741 exploited in LastPass breach). Media servers often have broad network access and may store sensitive content. Risk increases daily as attackers can reverse-engineer public patches.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update Plex Media Server to version 1.43.3 or later via the official downloads page or server management interface
• Update Plex Desktop client to version 1.115.0 or later from the official downloads page
• For NAS deployments (QNAP, Synology, etc.), manually install Plex Media Server 1.43.3 package if not yet available in vendor package manager
• Review Plex server access logs for suspicious authentication attempts or unusual API calls prior to patching
• Verify that Plex Media Server is not directly exposed to the internet; use VPN or reverse proxy with authentication if remote access is required