Plex tells users to update now as it patches unspecified security flaws
The media server company emailed customers directly, a rare step, and is holding back details until CVE numbers are assigned.
Key points
- Plex released Plex Media Server 1.43.3 on 19 May and Plex Desktop 1.115.0 on 13 August to fix multiple security bugs.
- The company emailed affected users this week urging an immediate update, a step it rarely takes.
- All Plex Media Server versions 1.43.2 and earlier are affected.
- CVE tracking numbers have been requested but not yet published.
- Users on network storage devices may need to install the update manually if their device's app store hasn't caught up.
Plex, the company behind the popular home media streaming software, has told users to update right away to fix a batch of security holes it isn't yet describing in public.
The warning went out this week by email to people running affected versions. Plex normally posts a note and lets users find it. Sending email is unusual, and it signals the company wanted these messages read.
The fixes live in Plex Media Server 1.43.3, released on 19 May, and Plex Desktop 1.115.0, released on 13 August. Anything on Plex Media Server 1.43.2 or older is vulnerable.
What did Plex actually say?
Not much, and that's the point. Plex confirmed it patched "a number of security issues" and asked server owners and desktop users to move to the latest builds. It has requested CVE identifiers, the standard reference numbers researchers use to track individual bugs, and says it will share details once those are published.
That silence is deliberate. Once a patch ships, skilled attackers can compare the old and new code to work out what changed and build an exploit from it. The narrower the window between patch and public detail, the better for users who've already updated. Our 25 August piece on silent software patches covers exactly how that tension plays out when companies go too far the other way.
Who needs to do what?
If you run a Plex server at home, open the server's web dashboard and update to 1.43.3 or later. The Plex Desktop app on Windows or macOS needs updating to 1.115.0 or later. Both are on the official Plex downloads page.
One wrinkle, first reported by BleepingComputer: if your Plex server runs on a network-attached storage box, a small always-on device that holds your files on your home network, the update may not have arrived in that device's built-in package manager yet. Plex says you can install it by hand in the meantime.
| Product | Fixed version | Released |
|---|---|---|
| Plex Media Server | 1.43.3 | 19 May 2025 |
| Plex Desktop | 1.115.0 | 13 August 2025 |
| Plex Media Server 1.43.2 and earlier | Vulnerable | Update required |
Should Plex users be worried?
Not panicked, but not casual either. Plex has form. In August 2025 it patched CVE-2025-34158, a high-severity flaw that let attackers steal a server owner's login details. Back in 2020, CVE-2020-5741 allowed remote code execution, meaning an attacker could make the server run their own commands. CISA flagged that one in March 2023 as actively exploited.
That 2020 bug matters because of what followed. LastPass has said one of its senior DevOps engineers was hacked in 2022 through a remote code execution flaw in third-party media software on their home computer. Attackers planted keylogging malware, software that records every keystroke, stole the engineer's credentials, and eventually pulled off a massive LastPass breach that same year. A home media server sat at the start of that chain.
Also in August 2022, Plex disclosed a breach of a database containing emails, usernames and encrypted credentials, and told users to reset their passwords.
Update now, use a unique password for your Plex account, and turn on two-factor authentication if you haven't. A media server is a small target until it's the way into something bigger.
