Plex has urged users to promptly update their Plex Media Server and Plex Desktop software following the release of fixes for several undisclosed security issues in older versions.
The recommended versions are Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company advises that all server owners and desktop users upgrade to the latest release without delay.
Plex Urges Users to Update Media Server
This advisory specifically applies to Plex Media Server version 1.43.2 and earlier. Plex did not disclose the types of vulnerabilities, their severity ratings, the components affected, or the conditions that could be exploited.
While CVE identifiers have been requested, the company will provide additional information in its security notice thread once the identifiers are published.
Due to limited information disclosure, administrators cannot yet reliably assess whether their deployment is at risk based on specific features or configurations. Until more technical details are available, upgrading should be considered the primary mitigation measure.
Organizations should identify every instance of Plex, including home servers, departmental systems, NAS appliances, and container deployments, rather than relying solely on a centrally managed system.
Plex also cautioned that the server package may not be immediately available in every NAS vendor’s package manager. In such cases, it is recommended to download the appropriate package from the official Media Server downloads page and follow the installation procedure outlined in the device manufacturer’s manual.
This is especially critical for NAS servers, where update availability may lag behind Plex’s release schedule.
For users on Windows and macOS with automatic updates enabled, it’s important to confirm that the installed Media Server version is 1.43.3 or later. Administrators who update manually should obtain the current package directly from Plex rather than from third-party sources.
Linux users should download the version suitable for their distribution, such as a .deb for Ubuntu or an .rpm for Fedora and CentOS, and install the package using their standard package-installation procedures.
Docker users should refer to Plex’s official PMS-Docker repository documentation before updating an image. They should check the image tag and deployed version after the update, then recreate or restart the container as dictated by their deployment method. NVIDIA Shield users can find pending Plex updates on the Google Play Store.
After applying the patches, administrators should ensure that the Plex service starts correctly, verify the version in the server interface, and review remote access settings, administrator accounts, and active sessions.
Where feasible, they should limit internet exposure to only the necessary services and keep logs in case later CVE details point to any suspicious activity that requires investigation.
Although public technical details are scarce, the urgency for operational response remains high. Media servers typically have extensive access to local content libraries and may be exposed externally for streaming. Promptly applying the vendor’s fixed releases is the best way to mitigate risk. At the same time, Plex prepares a more comprehensive vulnerability disclosure.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
