How to find Plex Media Server installations on your network

Matthew Kienow

Updated September 29, 2025, 10:57am EDT

Latest Plex Media Server vulnerability #

Plex released a security update for a currently undisclosed vulnerability stemming from an incorrect resource transfer between spheres in certain versions of Plex Media Server. The flaw was reported to Plex through its bug bounty program, and further details are not yet public. This vulnerability has been designated CVE-2025-34158 and has been rated high with a CVSS score of 8.5.

The following versions are affected

Plex Media Server versions 1.41.7.x through 1.42.0.x

What is the impact? #

The impact of the vulnerability is currently unknown. However, Plex "strongly recommends" that users update to the latest version as quickly as possible.

Are updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

Plex Media Server upgrade to version 1.42.1 or later

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:=Plex AND product:"Media Server" AND (version:>0 AND version:<"1.42.1")

Written by Matthew Kienow

Matthew Kienow is a software engineer and security researcher. Matthew previously worked on the Recog recognition framework, AttackerKB as well as Metasploit's MSF 5 APIs. He has also designed, built, and successfully deployed many secure software solutions; however, often he enjoys breaking them instead. He has presented his research at various security conferences including DerbyCon, Hack In Paris, and CarolinaCon. His research has been cited by CSO, Threatpost and SC Magazine.

More about Matthew Kienow

Explore more

Watch Now • On Demand

Vulnerability management is broken: what's the fix?

HD Moore and Omdia analyst Rik Turner discuss why traditional vulnerability management is struggling in modern IT infrastructures, why CVEs don’t tell the full story, and why prioritization alone isn’t enough to close critical security gaps.

Watch Now