PLEX has issued an urgent security update affecting both its desktop client and the Plex Media Server, urging immediate upgrades to Plex Desktop 1.115.0 or later and Plex Media Server 1.43.3 or newer. The company indicated the vulnerability is serious enough to warrant pre-release notification, though no vulnerability details, severity rating, or exploitation method have been disclosed yet, and there was no public evidence of active exploitation at the time of the advisory.
The public CVE identifiers are still pending, with Plex stating it intends to publish technical particulars once those identifiers are approved. The release underscores the potential risk to users if left unpatched.
Users should apply updates promptly, with extra caution for Docker deployments and NAS devices. For desktop users, updating is straightforward, while server updates require upgrading the server package. Linux users can upgrade via the appropriate package, and those running Plex in Docker containers will need to refresh the container image.
NAS users should consider manual upgrade rather than waiting for app-store review, as devices from manufacturers such as Synology, QNAP and TerraMaster often rely on store approvals. Exposed internet-facing Plex servers on the default port 32400 are highlighted as particularly at risk once the flaw becomes public, so timely application of the update is essential to mitigate potential remote compromise.