{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84731", "assignerOrgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d", "state": "PUBLISHED", "assignerShortName": "Nutanix", "dateReserved": "2026-09-02T06:41:54.722Z", "datePublished": "2026-10-15T17:10:29.432Z", "dateUpdated": "2026-10-15T19:14:57.185Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d", "shortName": "Nutanix", "dateUpdated": "2026-10-15T17:10:29.432Z"}, "title": "Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS", "datePublic": "2026-10-15T17:11:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-290", "description": "CWE-290 Authentication bypass by spoofing", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-302", "description": "CWE-302 Authentication bypass by Assumed-Immutable data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "Nutanix", "product": "Acropolis Operating System (AOS)", "modules": ["Prism Gateway"], "versions": [{"status": "affected", "version": "0", "lessThan": "7.3.1.18", "changes": [{"at": "7.3.1.18", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "7.5", "lessThan": "7.5.2", "changes": [{"at": "7.5.2", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "7.6", "lessThan": "7.6.0.8", "changes": [{"at": "7.6.0.8", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "7.3.1.18"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.5", "versionEndExcluding": "7.5.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.6", "versionEndExcluding": "7.6.0.8"}]}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.</p><p>Consequently, the server responds with a <code>Set-Cookie</code> header containing a valid <code>JSESSIONID</code>. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.</p>"}]}], "tags": ["x_api-security", "x_unauthenticated-access", "x_prism-gateway", "x_aos", "x_pre-auth", "x_rce"], "references": [{"url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf", "tags": ["vendor-advisory"]}, {"url": "https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS", "tags": ["release-notes"]}, {"url": "https://www.nutanix.com/support", "tags": ["x_support"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "HIGH", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV2_0": {"version": "2.0", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"other": {"type": "ssvc", "content": {"options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CNA", "version": "2.0.3"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "configurations": [{"lang": "en", "value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."}]}], "workarounds": [{"lang": "en", "value": "Organizations can mitigate this issue prior to patching by enforcing the following controls:\n\n  *  Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\n\n  *  Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u00a0the cluster.\n\n\n\nNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>Organizations can mitigate this issue prior to patching by enforcing the following controls</span>:</p><ul><li><strong>Network Segmentation:</strong> Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.<br></li><li><strong>Ingress Traffic Filtering:</strong> Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach<span>&nbsp;the cluster.</span><br></li></ul><div><i>Note on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.</i></div>"}]}], "solutions": [{"lang": "en", "value": "Upgrade affected Nutanix AOS deployments to version\u00a07.3.1.18, 7.5.2, 7.6.0.8\u00a0or later fixed releases.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade affected Nutanix AOS deployments to version&nbsp;<b>7.3.1.18, 7.5.2, 7.6.0.8</b>&nbsp;or later fixed releases.<br></p>"}]}], "exploits": [{"lang": "en", "value": "Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.<br></p>"}]}], "timeline": [{"time": "2026-08-26T17:47:00.000Z", "lang": "en", "value": "Vulnerability reported to Nutanix via HackerOne"}, {"time": "2026-08-27T20:46:00.000Z", "lang": "en", "value": "Proof of concept validated."}, {"time": "2026-09-17T13:08:00.000Z", "lang": "en", "value": "Remediation verified across affected release branches."}, {"time": "2026-09-22T17:27:00.000Z", "lang": "en", "value": "Fix integrated into AOS maintenance releases."}, {"time": "2026-10-04T18:30:00.000Z", "lang": "en", "value": "AOS version 7.6.0.8 released."}, {"time": "2026-10-05T18:30:00.000Z", "lang": "en", "value": "AOS version 7.3.1.18 released."}, {"time": "2026-10-12T18:30:00.000Z", "lang": "en", "value": "AOS version 7.5.2 released."}, {"time": "2026-10-15T17:11:00.000Z", "lang": "en", "value": "Public security advisory and CVE published."}], "credits": [{"lang": "en", "value": "Brandon McGrath (mez-0)", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}, "x_gcve": [{"vulnId": "CVE-2026-84731", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-84731", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T17:29:00.505460Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T19:14:57.185Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-84731", "date": "2026-10-23", "epss": "0.01283", "percentile": "0.69885"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-84731\",\"sourceIdentifier\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"published\":\"2026-10-15T18:17:29.960\",\"lastModified\":\"2026-10-16T19:55:59.740\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\\n\\n\\n\\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\"}],\"affected\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"affectedData\":[{\"vendor\":\"Nutanix\",\"product\":\"Acropolis Operating System (AOS)\",\"defaultStatus\":\"unaffected\",\"modules\":[\"Prism Gateway\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"7.3.1.18\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"7.3.1.18\",\"status\":\"unaffected\"}]},{\"version\":\"7.5\",\"lessThan\":\"7.5.2\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"7.5.2\",\"status\":\"unaffected\"}]},{\"version\":\"7.6\",\"lessThan\":\"7.6.0.8\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"7.6.0.8\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Red\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NEGLIGIBLE\",\"Automatable\":\"YES\",\"Recovery\":\"USER\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"HIGH\",\"providerUrgency\":\"RED\"}}],\"cvssMetricV31\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"ssvcData\":{\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CNA\",\"version\":\"2.0.3\"}},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-10-15T17:29:00.505460Z\",\"id\":\"CVE-2026-84731\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"},{\"lang\":\"en\",\"value\":\"CWE-302\"},{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://download.nutanix.com/alerts/Security_Advisory_0058.pdf\",\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\"},{\"url\":\"https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS\",\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\"},{\"url\":\"https://www.nutanix.com/support\",\"source\":\"2ffdacf6-8681-47df-b023-4f11abd61c1d\"}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-84731\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T17:29:00.505460Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T19:11:37.291Z\"}}], \"cna\": {\"tags\": [\"x_api-security\", \"x_unauthenticated-access\", \"x_prism-gateway\", \"x_aos\", \"x_pre-auth\", \"x_rce\"], \"title\": \"Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Brandon McGrath (mez-0)\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NEGLIGIBLE\", \"version\": \"4.0\", \"Recovery\": \"USER\", \"baseScore\": 9.3, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"RED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 10, \"accessVector\": \"NETWORK\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"authentication\": \"NONE\", \"integrityImpact\": \"COMPLETE\", \"accessComplexity\": \"LOW\", \"availabilityImpact\": \"COMPLETE\", \"confidentialityImpact\": \"COMPLETE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"role\": \"CNA\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Nutanix\", \"modules\": [\"Prism Gateway\"], \"product\": \"Acropolis Operating System (AOS)\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"7.3.1.18\", \"status\": \"unaffected\"}], \"version\": \"0\", \"lessThan\": \"7.3.1.18\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"7.5.2\", \"status\": \"unaffected\"}], \"version\": \"7.5\", \"lessThan\": \"7.5.2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"7.6.0.8\", \"status\": \"unaffected\"}], \"version\": \"7.6\", \"lessThan\": \"7.6.0.8\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.<br></p>\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-26T17:47:00.000Z\", \"value\": \"Vulnerability reported to Nutanix via HackerOne\"}, {\"lang\": \"en\", \"time\": \"2026-08-27T20:46:00.000Z\", \"value\": \"Proof of concept validated.\"}, {\"lang\": \"en\", \"time\": \"2026-09-17T13:08:00.000Z\", \"value\": \"Remediation verified across affected release branches.\"}, {\"lang\": \"en\", \"time\": \"2026-09-22T17:27:00.000Z\", \"value\": \"Fix integrated into AOS maintenance releases.\"}, {\"lang\": \"en\", \"time\": \"2026-10-04T18:30:00.000Z\", \"value\": \"AOS version 7.6.0.8 released.\"}, {\"lang\": \"en\", \"time\": \"2026-10-05T18:30:00.000Z\", \"value\": \"AOS version 7.3.1.18 released.\"}, {\"lang\": \"en\", \"time\": \"2026-10-12T18:30:00.000Z\", \"value\": \"AOS version 7.5.2 released.\"}, {\"lang\": \"en\", \"time\": \"2026-10-15T17:11:00.000Z\", \"value\": \"Public security advisory and CVE published.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade affected Nutanix AOS deployments to version\\u00a07.3.1.18, 7.5.2, 7.6.0.8\\u00a0or later fixed releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>Upgrade affected Nutanix AOS deployments to version&nbsp;<b>7.3.1.18, 7.5.2, 7.6.0.8</b>&nbsp;or later fixed releases.<br></p>\", \"base64\": false}]}], \"datePublic\": \"2026-10-15T17:11:00.000Z\", \"references\": [{\"url\": \"https://download.nutanix.com/alerts/Security_Advisory_0058.pdf\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://www.nutanix.com/support\", \"tags\": [\"x_support\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Organizations can mitigate this issue prior to patching by enforcing the following controls:\\n\\n  *  Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\\n\\n  *  Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\\u00a0the cluster.\\n\\n\\n\\nNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p><span>Organizations can mitigate this issue prior to patching by enforcing the following controls</span>:</p><ul><li><strong>Network Segmentation:</strong> Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.<br></li><li><strong>Ingress Traffic Filtering:</strong> Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach<span>&nbsp;the cluster.</span><br></li></ul><div><i>Note on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.</i></div>\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.\\n\\n\\n\\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.</p><p>Consequently, the server responds with a <code>Set-Cookie</code> header containing a valid <code>JSESSIONID</code>. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.</p>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing authentication for critical function\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290 Authentication bypass by spoofing\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-302\", \"description\": \"CWE-302 Authentication bypass by Assumed-Immutable data\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3.1.18\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.5.2\", \"versionStartIncluding\": \"7.5\"}, {\"criteria\": \"cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.6.0.8\", \"versionStartIncluding\": \"7.6\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"2ffdacf6-8681-47df-b023-4f11abd61c1d\", \"shortName\": \"Nutanix\", \"dateUpdated\": \"2026-10-15T17:10:29.432Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-84731\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T19:14:57.185Z\", \"dateReserved\": \"2026-09-02T06:41:54.722Z\", \"assignerOrgId\": \"2ffdacf6-8681-47df-b023-4f11abd61c1d\", \"datePublished\": \"2026-10-15T17:10:29.432Z\", \"assignerShortName\": \"Nutanix\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}