Full Report
Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The streaming media service did not elaborate on what those issues are, but said CVE identifiers have been requested for them. "We recommend all server owners and Desktop users
Analysis Summary
# Vulnerability: Multiple Undisclosed Flaws in Plex Media Server and Desktop
## CVE Details
* **CVE ID:** Pending (Identifiers have been requested by Plex)
* **CVSS Score:** Unknown (Severity likely High based on immediate update urgency)
* **CWE:** Unknown (Undisclosed)
* **Historical Reference:** The article references a related recent flaw, **CVE-2025-34158** (CVSS 8.5, High), involving authentication bypass via the `/myplex/account` endpoint.
## Affected Systems
* **Products:** Plex Media Server, Plex Desktop
* **Versions:**
* Plex Media Server: Versions 1.43.2 and earlier
* Plex Desktop: Versions prior to 1.115.0
* **Configurations:** All installations, including those running on NAS (Network Attached Storage) devices.
## Vulnerability Description
While specific technical details for the September 2026 update remain undisclosed by the vendor, the patches address "multiple security flaws." Based on the vendor's urgent recommendation, these flaws likely involve unauthorized access or remote exploitation risks similar to previous vulnerabilities in the platform's API endpoints (such as the `/myplex/account` and `/api/resources` chain which previously allowed administrative token exposure).
## Exploitation
* **Status:** Not explicitly reported as exploited in the wild for the *current* undisclosed flaws; however, Plex software is a frequent target for threat actors (e.g., the 2022 LastPass breach via CVE-2020-5741).
* **Complexity:** Unknown (Assumed Medium)
* **Attack Vector:** Network (Remote)
## Impact
* **Confidentiality:** High (Potential for account detail and administrative token exposure)
* **Integrity:** High (Potential for unauthorized server configuration changes)
* **Availability:** Medium to High (Risk of service disruption)
## Remediation
### Patches
Update to the following versions immediately:
* **Plex Media Server:** Version 1.43.3 or newer
* **Plex Desktop:** Version 1.115.0 or newer
### Workarounds
* **Manual Installation:** For NAS users whose package managers have not yet updated, download and install the update package manually from the official Plex website.
* **Access Control:** Ensure the server is not exposed to the public internet unless necessary. Use a VPN for remote access to reduce the attack surface.
## Detection
* **Indicators of Compromise:** Monitor for unusual administrative API calls, particularly those targeting `/myplex/account` or `/api/resources` from unrecognized IP addresses.
* **Detection methods and tools:** Use external scanning tools (e.g., Censys) to verify if your Plex Media Server web interface is publicly exposed. Audit Plex server logs for unauthorized access tokens or sessions.
## References
* **Vendor Advisory:** [https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319)
* **External Reference:** [https://thehackernews.com/2026/09/plex-urges-immediate-updates-after.html](https://thehackernews.com/2026/09/plex-urges-immediate-updates-after.html)
* **Historical Context (CVE-2025-34158):** [https://nvd.nist.gov/vuln/detail/cve-2025-34158](https://nvd.nist.gov/vuln/detail/cve-2025-34158)