According to the advisory, CVE identifiers have been requested for the flaws, but none have been officially assigned at the time of writing. Plex has stopped short of explaining the potential impact or attack vectors, which is unusual for the vendor and suggests these issues were handled with heightened caution.

Plex is specifically directing all server owners and Desktop users to upgrade to the newest builds as soon as possible. Given the lack of public disclosure, there is no additional information available regarding workarounds or specific affected configurations beyond the version numbers listed.

• Affected products: Plex Media Server (prior to 1.43.3) and Plex Desktop (prior to 1.115.0)
• Action required: Upgrade to Plex Media Server 1.43.3 or Plex Desktop 1.115.0 immediately
• Status: CVE identifiers pending; no further technical disclosures have been made

If you run a Plex instance on a NAS or an always-on home server, it is worth checking whether automatic updates have already applied, as delayed patching could leave your media library and potentially your local network exposed.

Source: The Hacker News

Given the lack of detail here, how is your team handling the update push for Plex installations across your user base?