PLEX has issued a security update urging users to upgrade to the latest releases after patching multiple undisclosed flaws in its Plex Media Server and Plex Desktop products. The company states that the fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. It did not disclose the exact vulnerabilities in its notice, but said that CVE identifiers have been requested for the issues.
Plex also noted that if Plex Media Server runs on a NAS device, the updated software may not be available in the package manager yet and advised manual installation.
The article recalls a high-severity incident from August 2025 linked to CVE-2025-34158, an authentication flaw affecting the /myplex/account endpoint that could expose administrative tokens and owner details, along with a separate API surface at /api/resources that could reveal other servers in the owner’s Plex infrastructure. It also cites data suggesting more than 360,000 devices expose the Plex Media Server web interface, while stressing that not all exposed servers are necessarily vulnerable.
The piece references past Plex security activity and cautions users to apply the new versions promptly to mitigate potential exploitation. In summary, Plex’s latest update aims to address multiple previously undisclosed flaws, with active CVE tagging in progress and a clear recommendation for both server owners and Desktop users to upgrade where possible.