Patch & vulnerability status
Plex, Inc.
Plex Media Server 1.43.3.10861-07dfddaeb
Latest tracked version 1.43.3.10861-07dfddaeb. Release status, tracked CVEs, and automated cross-platform patching for Plex Media Server.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 1.43.3.10861-07dfddaeb | 14 | 2026-08-10 |
Known vulnerabilities (CVEs) in Plex Media Server
Lavawall tracks 14 published CVEs affecting Plex Media Server, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2025-69417 | 2026-01-02 17:16:25 | MEDIUM (5) | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint. | NETWORK |
| CVE-2025-69416 | 2026-01-02 17:16:24 | MEDIUM (5) | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml. | NETWORK |
| CVE-2025-69415 | 2026-01-02 17:16:24 | HIGH (7) | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. | NETWORK |
| CVE-2025-69414 | 2026-01-02 17:16:24 | HIGH (9) | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. | NETWORK |
| CVE-2021-42835 | 2021-12-08 15:15:10 | HIGH (7) | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM). | LOCAL |
| CVE-2021-33959 | 2023-01-18 14:15:11 | HIGH (8) | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. | NETWORK |
| CVE-2020-5742 | 2020-06-15 20:15:12 | HIGH (9) | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. | NETWORK |
| CVE-2020-5741 | 2020-05-08 13:15:11 | HIGH (7) | Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. | NETWORK |
| CVE-2020-5740 | 2020-04-22 16:15:13 | HIGH (8) | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. | LOCAL |
| CVE-2019-19141 | 2019-12-19 23:15:16 | HIGH (9) | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH. | NETWORK |
| CVE-2018-21031 | 2019-11-18 17:15:11 | MEDIUM (7) | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product. | NETWORK |
| CVE-2018-13415 | 2018-08-13 17:29:01 | HIGH (8) | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains. | NETWORK |
| CVE-2014-9304 | 2014-12-07 21:59:06 | HIGH (8) | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server. | NETWORK |
| CVE-2014-9181 | 2014-12-02 16:59:18 | MEDIUM (5) | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/. | NETWORK |
Why keeping Plex Media Server patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every Plex Media Server release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches Plex Media Server
Lavawall® watches Plex Media Server releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on Plex Media Server, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
What is the latest version of Plex Media Server?
Lavawall tracks Plex Media Server at version 1.43.3.10861-07dfddaeb (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks Plex Media Server at version 1.43.3.10861-07dfddaeb (last checked 2026-08-10). New releases are monitored continuously and can be deployed automatically across your fleet.
Does Plex Media Server have known security vulnerabilities (CVEs)?
Lavawall tracks 14 CVEs for Plex Media Server and remediates them automatically as part of patching.
Lavawall tracks 14 CVEs for Plex Media Server and remediates them automatically as part of patching.
How do I patch Plex Media Server automatically?
Deploy the Lavawall® agent and Plex Media Server updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Deploy the Lavawall® agent and Plex Media Server updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for Plex Media Server through public information and proprietary statistical analysis, and can patch it automatically across your fleet.