Skip to content
Today
Sections

Security Independently confirmed3 publishers 2 min read Published Updated

Plex tells NAS owners to hand-install a security release it will not describe

Plex Media Server 1.43.3 and Desktop 1.115.0 fix flaws that still carry no CVE IDs and no description, which leaves anyone running the server on a NAS waiting on a package manager while the patched builds are already public.

The Watch · Security desk

Send a correction

Illustration accompanying Plex tells NAS owners to hand-install a security release it will not describe
Generated illustration

What happened

  • Plex told all server owners and Desktop users to move to Plex Media Server 1.43.3 and Plex Desktop 1.115.0, saying only that the builds address a number of security issues.
  • CVE identifiers have been requested but not yet published, and BleepingComputer reports the issues are known to affect Plex Media Server 1.43.2 and earlier.
  • Plex also emailed users running affected versions, which BleepingComputer notes is one of the few times the company has mailed customers directly about upgrading.
  • Plex told NAS operators the updated version may not be in their device's package manager yet and pointed them to installing the package by hand instead.

Why it matters

  • What's now possible capability With no advisory text, the quickest route to understanding what changed is a binary comparison of the two builds, and the builds shipped before the warning did.
  • Who's exposed exposure The slowest-patching part of the install base is the part Plex cannot reach directly, because the fix arrives on a third-party build schedule and then only if the owner performs a manual install per device.
  • What it sets up precedent A home Plex server has already been the pivot into an enterprise credential store once, so pricing these bugs as a consumer media problem understates who ends up paying.
  • What it limits constraint Without severity, affected component, or authentication requirement, defenders cannot rank this against the rest of the queue and have to treat it as urgent by default.

Plex has published a version number and an instruction, not a vector [3]. The missing detail is the one triage depends on: whether anything fixed in 1.43.3 is reachable without an account on the server.

Last August's bug is the useful comparison. CVE-2025-34158, rated CVSS 8.5, had the `/myplex/account` endpoint hand the server owner's account details, including the administrative access token, to any authenticated non-owner or lower-privileged user [7]. A follow-up `/api/resources` call then enumerated the other servers that owner could reach, turning the pair into infrastructure discovery [8]. That chain needed an account, and plenty of home servers issue those to friends. With no equivalent detail on the current set, every owner has to patch as if the worst case applies.

The diff is the other half. BleepingComputer dates Plex Media Server 1.43.3 to May 19 and Plex Desktop 1.115.0 to August 13, and Plex withheld details on Tuesday [17][6]. Both patched builds were therefore downloadable before Plex said what they fixed [19]. Anyone comparing 1.43.2 with 1.43.3 starts from a fixed version pair and a narrow set of changed functions; BleepingComputer's own advice is to patch before attackers reverse-engineer the fixes and build an exploit [20]. The silence delays defenders more than it delays that work.

Censys counts more than 360,000 devices exposing the Plex Media Server web interface, and not all of them are vulnerable [14]. Read that as a measure of reachability, not of the bug. It is also a population with no central patch channel and no admin watching a forum thread.

The reason this matters past home libraries is documented, not theoretical. CISA flagged CVE-2020-5741, a Plex Media Server remote code execution flaw scored CVSS 7.2, as actively exploited in March 2023 [9][10]. That flaw was the way into a LastPass engineer's home computer, where attackers implanted keylogger malware [11]; they used the captured credentials to reach the LastPass corporate vault and steal database backups, producing the August 2022 breach [12]. Plex's other history is more mundane: a February 2021 fix stopped servers reflecting UDP packets to amplify denial-of-service traffic, restricting responses to the LAN from v1.21.3.4014 [18], and in August 2022 Plex told users to reset passwords after attackers reached a database of emails, usernames, and encrypted credentials [15].

Neither publisher reports exploitation of the flaws fixed this week, and no severity scores, affected components, or CVE numbers have been published [16]. The only public artifact is the patch, and on a NAS it arrives when the package maintainer gets to it [5].

What to watch

  • Publication of the requested CVE IDs, which will show whether any fixed bug is reachable pre-authentication or needs an account on the server.
  • How long NAS vendor package repositories take to carry 1.43.3, measured against the May 19 build date.
  • Any exploit writeup or KEV entry built from a 1.43.2 to 1.43.3 binary comparison.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption40
Hype gap+20
Incentives
Not scored
Confidence55

Perspective Coverage

3 publishers
Builder
Builder 23%
Operator
Operator 67%
Investor
Investor 10%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Plex said in an announcement this week: "We recommend all server owners and Desktop users update to the latest version as soon as possible."

    Reported Supported Source: Plex, via The Hacker NewsView cited source
  2. [2]

    The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0.

    Reported SupportedView cited source
  3. [3]

    Plex did not elaborate on what the security issues are, but said CVE identifiers have been requested for them and that it will post details once published.

    Reported SupportedView cited source
  4. [4]

    The security issues are known to affect Plex Media Server v1.43.2 and earlier, and have not yet been assigned CVE IDs.

    Reported Supported Source: BleepingComputerView cited source
  5. [5]

    Plex said that if Plex Media Server is running on a NAS device, the updated version may not be available in the device's package manager yet, but the package can be installed manually.

    Reported Supported Source: PlexView cited source
  6. [6]

    Plex did not provide additional details on Tuesday when it urged users to update.

    Reported Supported Source: BleepingComputerView cited source
  7. [7]

    In August 2025 Plex addressed CVE-2025-34158 (CVSS 8.5), an authentication bug in which the /myplex/account endpoint exposed the server owner's account details, including their administrative access token, to any authenticated non-owner or lower-privileged user.

    Reported SupportedView cited source
  8. [8]

    A subsequent /api/resources API call could reveal other servers accessible by the server owner, and the combination of the two calls forms an exploit chain leading to infrastructure discovery.

    Reported SupportedView cited source
  9. [9]

    In March 2023 CISA flagged a Plex Media Server remote code execution flaw, CVE-2020-5741, as actively exploited.

    Reported SupportedView cited source
  10. [10]

    CVE-2020-5741 carries a CVSS score of 7.2.

    Reported SupportedView cited source
  11. [11]

    The August 2022 LastPass breach was driven by attackers implanting keylogger malware on an employee's home computer after compromising it through CVE-2020-5741.

    Reported SupportedView cited source
  12. [12]

    The attackers used that access to steal the engineer's credentials and compromise the LastPass corporate vault, stealing LastPass database backups.

    Reported SupportedView cited source
  13. [13]

    Plex emailed users running affected versions asking them to update as soon as possible; BleepingComputer says this is one of the few instances where Plex has also emailed customers about upgrading their systems for a specific vulnerability.

    Reported Supported Source: BleepingComputerView cited source
  14. [14]

    Censys data shows more than 360,000 devices exposing the Plex Media Server web interface, although not all of them are vulnerable.

    Reported Supported Source: Censys, via The Hacker NewsView cited source
  15. [15]

    In August 2022 Plex notified users of a data breach and warned them to reset passwords after attackers gained access to a database containing emails, usernames, and encrypted credentials.

    Reported SupportedView cited source
  16. [16]

    Neither publisher reports exploitation of the flaws fixed in Plex Media Server 1.43.3, and no severity scores, affected components, or CVE numbers for them have been published.

    Derived Supported
  17. [17]

    BleepingComputer dates Plex Media Server 1.43.3 to a May 19 release and Plex Desktop 1.115.0 to an August 13 release.

    Reported Supported Source: BleepingComputerView cited source
  18. [18]

    In February 2021 Plex released a security update so that servers respond to UDP requests only from the local network, stopping their use to reflect and amplify denial-of-service traffic; the hotfix was Plex Media Server v1.21.3.4014 or newer.

    Reported SupportedView cited source
  19. [19]

    Both patched builds were downloadable before Plex disclosed that they were security releases.

    Derived Supported
  20. [20]

    BleepingComputer advised users to secure their systems before attackers reverse-engineer the patches and develop an exploit.

    Reported Insufficient Source: BleepingComputerView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 3, 2026

    Plex warns users to patch security vulnerabilities immediately
  2. scworld.com

    1 article · September 4, 2026

    Plex urges immediate updates for media server and desktop clients due to security vulnerabilities
  3. thehackernews.com

    2 articles · September 4, 2026

    Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Topics and entities

Topics

Entities