SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

Plex has released security updates for Plex Media Server and Plex Desktop and is urging users to upgrade immediately. Plex Media Server v1.43.2 and earlier should be moved to version 1.43.3; Plex Desktop should be updated to 1.115.0. CVE identifiers have been requested, and full technical details are not public yet. This article covers the fixed versions, how to update across Windows, macOS, Linux, NAS, Docker, and other platforms, and what administrators should do now.

Sep 15, 2026By Bapanapalli Prem Sai Siddhik

Summary

Plex has issued a security update for Plex Media Server and Plex Desktop and recommends that all server owners and Desktop users apply it as soon as possible. CVE identifiers have been requested; technical details will follow when they are published.

Why This Matters

Plex has not published severity scores or root-cause detail, but it has framed the release as a security update and asked for immediate action. Media servers are often reachable beyond the local network. Delaying the update could increase the risk of exploitation, particularly once technical details or proof-of-concept research becomes available especially where remote access is enabled or the server runs on a NAS that lags behind package-manager updates.

Affected and Fixed Versions

Affected:

  • Plex Media Server v1.43.2 and earlier

Fixed in:

  • Plex Media Server 1.43.3
  • Plex Desktop 1.115.0

Packages are available from the Plex downloads page.

How to Update

Platform-specific steps are listed in the official Plex security announcement. In summary:

  • Windows and macOS: Confirm automatic updates reached the fixed server build, or install manually from the downloads page.
  • Linux (Ubuntu): Install the current .deb with sudo dpkg -i using the file downloaded.
  • Linux (Fedora/CentOS): Install the current .rpm with sudo dnf install using the file downloaded.
  • Docker: Use the guidance in the official pms-docker repository.
  • NVIDIA SHIELD: Install pending updates from the Google Play store.
  • NAS systems: The fixed package may not appear in the vendor store yet. Download the correct build from Plex, open the NAS web interface, use the app store's manual install path (App Store / App Center / Applications), and complete the wizard.

Device-specific guides linked by Plex:

If installation fails, check the Plex Media Server NAS forums for device-specific guidance.

Recommended Actions

  • Move every server and Desktop client to the fixed releases listed above.
  • On NAS, use manual install when the store is still on an older build.
  • Confirm the running version in server settings after the upgrade.
  • Watch the Plex announcement thread for CVE IDs when they are published.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated solution that helps you quickly remediate risks, including critical third-party application updates. It supports Windows, Linux, macOS, and 550+ third-party applications.

You can stage patches in a safe testing environment before production deployment and roll back if needed.

Experience the fastest and most accurate patching software here.

Featured Posts

Open F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws
vulnerability researchF5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

CVE Research

F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

Oct 19, 2026

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026

Open Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

CVE Research

Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.

Oct 16, 2026

Open Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution
vulnerability researchPalo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

CVE Research

Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Oct 15, 2026