Plex warns users to patch security vulnerabilities immediately
Plex urges users to update desktop clients and media servers to patch multiple security vulnerabilities.
Run Plex?
Get an email when a reviewed story names Plex, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Plex has released updates for its desktop clients and media servers to address multiple security vulnerabilities, urging users to patch immediately. While specific CVEs have not yet been assigned, the flaws affect Plex Media Server v1.43.2 and earlier. This advisory follows previous warnings about critical vulnerabilities, including one in 2025 that allowed credential theft and another in 2023 that was actively exploited for remote code execution, potentially linked to the LastPass breach.
The lesson from this incident
Full lessonPlex Media Server has disclosed multiple unpatched vulnerabilities affecting version 1.43.2 and earlier, urging users to update immediately before CVEs are formally assigned and exploits proliferate. This follows a troubling pattern: a 2023 Plex vulnerability was actively exploited for remote code execution and is believed to have contributed to the high-profile LastPass breach, while a 2025 flaw enabled credential theft. Consumer and prosumer media server software is frequently overlooked in patch cycles, yet these systems often run on home and corporate networks with access to sensitive files and credentials. Delaying patches on internet-exposed software—especially with a known history of exploitation—dramatically increases the window of opportunity for attackers.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2025-34158
- cve — CVE-2020-5741