Critical Alert 1 Active Exploit Detected Today

CVE-2026-86950 — Apple Multiple Products Out-of-Bounds Write Vulnerability →
Powered by CVE Watchtower
×
September 30, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-32647NVD

Vulnerability Summary

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity Level
HIGH(7.8)
Published Date
Mar 24, 2026
Last Modified
Jul 15, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.92%Probability
Root Weakness (CWE)
CWE-125: Out-of-bounds Read ↗
The software reads data past the end, or before the beginning, of the intended buffer.
CVSS v4.0 Base Metrics — Score 8.5 (HIGH)
Attack VectorLocal
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.8 (HIGH)
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • F5 NGINX Open Source >= 1.29.0 and < 1.29.7
  • F5 NGINX Open Source >= 1.1.19 and < 1.28.3
  • F5 NGINX Plus >= R36 and < R36 P3
  • F5 NGINX Plus >= R35 and < R35 P2
  • F5 NGINX Plus >= R34 and < *
  • F5 NGINX Plus >= R33 and < *
  • F5 NGINX Plus >= R32 and < R32 P5
Patched Versions
  • F5 NGINX Open Source 1.29.7
  • F5 NGINX Open Source 1.28.3
  • F5 NGINX Plus R36 P3
  • F5 NGINX Plus R35 P2
  • F5 NGINX Plus *
  • F5 NGINX Plus R32 P5
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References