If you run a Plex Media Server at home, check which version you are on. The company emailed owners of older builds in August 2025 and told them to update, citing a flaw it had already patched.
The email went out four days after the fix shipped. Plex said a user had reported a potential security issue through its bug bounty program, affecting Plex Media Server versions 1.41.7.x to 1.42.0.x. “Thanks to that user, we were able to address the issue, release an updated version of the server, and continue to improve our security and defenses,” the company wrote. It added: “We strongly recommend that everyone update their Plex Media Server to the most recent version as soon as possible, if you have not already done so.”
The fixed release is Plex Media Server 1.42.1.10060. It can be downloaded from the official downloads page or from the server management page. People got the message only if their Plex account showed a server running an older version.
What is still unknown
Plex had not assigned a CVE ID to the flaw and gave no further detail, as BleepingComputer reported. That silence has a cost. Users are urged to patch quickly, before threat actors reverse engineer the update and build an exploit.
Emailing customers about one specific vulnerability is rare for Plex, even though it has dealt with its share of critical and high-severity flaws over the years.
A history worth remembering
In March 2023, CISA flagged a three-year-old remote code execution bug in Plex Media Server, CVE-2020-5741, as actively exploited. Successful exploitation can let attackers make the server run malicious code. CISA gave no details on the attacks, but they were likely tied to LastPass’s disclosure that a senior DevOps engineer’s computer had been hacked in 2022. The attackers abused a remote code execution bug in third-party media software to install a keylogger, stole the engineer’s credentials and got into the corporate vault. The result was a major breach in August 2022, with LastPass’s production and critical database backups taken.
That same month, Plex told users about its own data breach and asked them to reset passwords. An attacker had reached a database holding emails, usernames and encrypted passwords.
