Back Gbhackers

F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File

Gbhackers •Divya • March 25, 2026

F5 has disclosed a high-severity vulnerability (CVE-2026-32647) in the NGINX ngx_http_mp4_module that allows attackers execute arbitrary code or cause a denial-of-service (DoS) using crafted MP4 files. This flaw impacts NGINX Plus and NGINX Open Source deployments where the MP4 streaming module is explicitly enabled in the server configuration. Vulnerability Details The security flaw, tracked as CVE-2026-32647, is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

F5 NGINX Plus & Open Source Vulnerability Allows Code Execution via MP4 Files F5 has disclosed a high-severity vulnerability, tracked as CVE-2026-32647, affecting both NGINX Plus and NGINX Open Source. This flaw allows attackers to execute arbitrary code or trigger a denial-of-service (DoS) condition by exploiting crafted MP4 files. The vulnerability specifically impacts deployments where the MP4 streaming module is enabled in the server configuration. The CVSS v4.0 base score for this vulnerability is 8.5, indicating a significant risk. Affected systems include any NGINX installations with the MP4 module active. Security teams are advised to review their configurations and apply necessary mitigations. The vulnerability was published on March 24, 2026, and is currently under scrutiny for potential exploits. 2 sources 69

Extracted Entities

Attack Types (1)

DDoS

Companies (1)

CVEs (1)

CVE-2026-32647

Tools (1)

Nginx