Vulnerabilities · 54 days ago
Plex pushed fixed builds for Media Server 1.43.3 and Desktop 1.115.0 on day one of an advisory covering multiple undisclosed flaws, and it is urging users to update immediately while CVE identifiers are still being requested. The update spans both sides of the Plex stack, not just the server.
The catch is deployment shape: Plex says NAS-hosted Media Server installs may not see the new package in a manager right away, even though the fix exists, and mixed environments can stay exposed if one component moves and the other does not. In plain terms, a patched desktop does not clean up an unpatched server, and package timing can leave NAS operators looking current when they are not.
For teams that split Plex administration across desktops, servers, and NAS appliances, the exposure now lives wherever the slower side still runs the old build. What remains open after the vendor release is not a new attack path, but the lag between a fixed version and the estate actually running it.
Known exploited · CISA KEV
CVSS 7.2 HIGH: deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute… EPSS 73% (99th percentile).
CISA federal remediation date Mar 31 · date passed
CVSS 8.5 HIGH: plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between… EPSS 0.6% (48th percentile).
2 sources covering this story
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex fixes multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging users to update.
Plex warns users to patch security vulnerabilities immediately
Plex urged users this week to update their desktop clients and media servers immediately to patch multiple security vulnerabilities.
Part of the PlainSec briefing for 2026-09-07