Plex pushed fixed builds for Media Server 1.43.3 and Desktop 1.115.0 on day one of an advisory covering multiple undisclosed flaws, and it is urging users to update immediately while CVE identifiers are still being requested. The update spans both sides of the Plex stack, not just the server.
The catch is deployment shape: Plex says NAS-hosted Media Server installs may not see the new package in a manager right away, even though the fix exists, and mixed environments can stay exposed if one component moves and the other does not. In plain terms, a patched desktop does not clean up an unpatched server, and package timing can leave NAS operators looking current when they are not.
For teams that split Plex administration across desktops, servers, and NAS appliances, the exposure now lives wherever the slower side still runs the old build. What remains open after the vendor release is not a new attack path, but the lag between a fixed version and the estate actually running it.
CVSS 7.2 HIGH: deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute… EPSS 73% (99th percentile).
CISA federal remediation date Mar 31 · date passed
CVSS 8.5 HIGH: plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between… EPSS 0.6% (48th percentile).