Description
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.



Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
Published: 2026-10-15
Score: 9.3 Critical
EPSS: 1.3% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated remote attacker can send a crafted internal management HTTP header to Nutanix Prism Element, causing the application’s authentication filters to misinterpret the request as already authenticated. The server responds with a Set‑Cookie header containing a JSESSIONID that decodes to a JSON Web Token granting maximum cluster administrative privileges. Successful exploitation allows the attacker to issue root‑level commands on all Controller VMs, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

Affected Systems

This vulnerability affects Nutanix Acropolis Operating System (AOS) deployments. Versions that have not been updated to 7.3.1.18, 7.5.2, or 7.6.0.8 (or later) are impacted. The CPE identifier confirms the scope is limited to the AOS platform.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is classified as critical, indicating a high likelihood of full compromise and extensive damage. The EPSS score of 0.01283% shows exploitation probability is very low but non‑zero, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector can be inferred to be a remote HTTP request to Prism Element’s management port (9440) from an external or compromised host that can insert the forged header, bypassing authentication before any user credentials are requested.

Generated by OpenCVE AI on October 16, 2026 at 20:49 UTC.

Remediation

Vendor Solution

Upgrade affected Nutanix AOS deployments to version 7.3.1.18, 7.5.2, 7.6.0.8 or later fixed releases.

Vendor Workaround

Organizations can mitigate this issue prior to patching by enforcing the following controls: * Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges. * Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach the cluster. Note on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.

OpenCVE Recommended Actions

  • Upgrade affected Nutanix AOS deployments to a fixed release such as 7.3.1.18, 7.5.2, or 7.6.0.8 or later
  • Enforce network segmentation so that only dedicated management VLANs, jump hosts, or authorized IP ranges can reach the Prism Element management port (9440)
  • Configure upstream Web Application Firewalls or ingress reverse proxies to strip internal management headers from incoming API requests before they reach the cluster; obtain the exact header string from Nutanix Support if necessary

Generated by OpenCVE AI on October 16, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
Title Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
First Time appeared Nutanix
Nutanix aos
Weaknesses CWE-290
CWE-302
CWE-306
CPEs cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*
Vendors & Products Nutanix
Nutanix aos
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red'}

Subscriptions

Nutanix Aos
cve-icon MITRE

Status: PUBLISHED

Assigner: Nutanix

Published:

Updated: 2026-10-15T19:14:57.185Z

Reserved: 2026-09-02T06:41:54.722Z

Link: CVE-2026-84731

cve-icon Vulnrichment

Updated: 2026-10-15T19:11:37.291Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T18:17:29.960

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-84731

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T21:00:14Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing

  • CWE-302

    Authentication Bypass by Assumed-Immutable Data

  • CWE-306

    Missing Authentication for Critical Function