Plex has pushed out Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to patch what the company describes only as “a number of security issues.” If you run a Plex server on a NAS, a home PC, or in Docker, this is one of those updates worth doing today rather than filing away for later.
What Plex actually said
The announcement came from Plex’s official forum account on September 1, 2026, in a post titled “Important security update for Plex Media Server v1.43.2 and earlier.” The text is short on specifics: Plex Media Server versions 1.43.2 and older are affected, the fix lands in 1.43.3, and the same round of patches applies to Plex Desktop, which moves to 1.115.0. Every server owner and every Desktop user is told to update as soon as possible.
What the post does not include is any technical breakdown of the vulnerabilities. Plex says CVE identifiers have been requested but were not yet public at the time of writing, so there is no CVSS score to point to and no confirmation of whether the issues are remotely exploitable, require authentication, or fall into some less severe category. Coverage from The Hacker News on September 4 confirms the same gap: Plex “did not elaborate on the nature of the flaws.” Anyone claiming otherwise right now is guessing.
That absence of detail is frustrating, but it is not a reason to wait. Update first; read the technical writeup whenever Plex or a researcher publishes one.
Why Plex’s track record makes this worth taking seriously
Plex has a real history of security issues that moved from “patched quietly” to “actively exploited,” which is the context that makes an update notice like this worth acting on even without CVE details.
- In August 2025, Plex fixed CVE-2025-34158 (CVSS 8.5), a high-severity authentication bug in which the
/myplex/accountendpoint could leak the server owner’s account information, including their admin access token, to any authenticated user who wasn’t the owner. A follow-up call to/api/resourcescould then reveal every other server that owner had access to, turning a single bug into a tool for mapping someone else’s infrastructure. - In February 2021, a Plex Media Server flaw was used for UDP amplification and reflection DDoS attacks. Plex fixed it in version 1.21.3.4014 by restricting UDP responses to the local network.
- The 2022 LastPass breach, made public in 2023, traced back in part to a compromised employee whose personal computer was running a vulnerable Plex Media Server. CVE-2020-5741 (CVSS 7.2) reportedly gave attackers the opening they needed to plant a keylogger on that machine.
None of that means the newly patched issues in 1.43.3 are comparable in severity. They might be far more minor. But the pattern of Plex vulnerabilities getting weaponized once they’re understood is exactly why treating “unspecified security issues” as low priority has bitten people before.
Scale adds to the argument. Censys data cited by The Hacker News shows more than 360,000 devices with a Plex Media Server web interface exposed to the public internet. That figure includes plenty of servers that are perfectly patched and configured, so it isn’t a vulnerability count. It’s a reminder of how large and visible the attack surface gets once something actually needs patching.
How to update
Desktop and server updates should be available directly inside the Plex app for most people. Where it gets more complicated is NAS deployments, since packaged builds don’t always reach vendor app stores as fast as Plex ships its own release. Plex has published manual installation instructions covering Windows, macOS, Linux (both .deb for Ubuntu-based systems and .rpm for Fedora/CentOS), generic NAS platforms with vendor-specific links for QNAP, TerraMaster, WD, Netgear, and Synology, Docker via the official pms-docker image on GitHub, and NVIDIA Shield through the Google Play Store.
If your NAS vendor hasn’t shipped the update yet, don’t assume you’re stuck waiting. Plex’s own manual packages let you update ahead of the vendor’s release cycle.
The bottom line
Plex Media Server 1.43.3 and Plex Desktop 1.115.0 fix security issues Plex has not detailed yet, and CVE numbers are still pending. That’s an unusual amount of silence to ask hundreds of thousands of server owners to act on faith. But given Plex’s history with account-token leaks, DDoS abuse, and a breach tied to an unpatched instance, updating now rather than waiting for the technical writeup is the reasonable call. Full details, including any CVE identifiers, will presumably follow. Check back on the official Plex forum thread for updates.
For more on running Plex as part of a self-hosted media stack, see our Plex application page, or our Plex server setup guide for a full walkthrough of the installation and configuration process.
Sources: Plex Forums — official announcement, The Hacker News coverage.