F5 NGINX Plus & Open Source Vulnerability Allows Code Execution via MP4 Files

F5 has disclosed a high-severity vulnerability, tracked as CVE-2026-32647, affecting both NGINX Plus and NGINX Open Source. This flaw allows attackers to execute arbitrary code or trigger a denial-of-service (DoS) condition by exploiting crafted MP4 files. The vulnerability specifically impacts deployments where the MP4 streaming module is enabled in the server configuration. The CVSS v4.0 base score for this vulnerability is 8.5, indicating a significant risk. Affected systems include any NGINX installations with the MP4 module active. Security teams are advised to review their configurations and apply necessary mitigations. The vulnerability was published on March 24, 2026, and is currently under scrutiny for potential exploits.

Key Points: • CVE-2026-32647 allows code execution via crafted MP4 files in NGINX deployments. • The vulnerability affects both NGINX Plus and NGINX Open Source with a CVSS v4.0 score of 8.5. • Immediate action is recommended for systems using the MP4 streaming module.