As reported by Bleeping Computer, Plex has issued an urgent call for users to update their desktop clients and media servers to address multiple security vulnerabilities affecting versions prior to Plex Media Server v1.43.3 and Plex Desktop 1.115.0.
While specific CVE identifiers have not yet been assigned, Plex has directly emailed users, emphasizing the critical need to update to the latest versions to mitigate these security risks. The company stated that CVEs have been requested and further details will be provided upon publication. Users running Plex Media Server on NAS devices are advised to manually install the updated package if it's not yet available through their device's package manager.
This advisory follows a history of security concerns, including a high-severity vulnerability (CVE-2025-34158) in August 2025 that allowed for credential theft, and a previously exploited remote code execution flaw (CVE-2020-5741) in March 2023. The latter was linked to the LastPass breach, where a third-party media software vulnerability was used to install malware. Plex itself experienced a data breach in August 2022, leading to a recommendation for users to reset passwords.
Source: Bleeping Computer
