CVE-2026-84731 (GCVE-0-2026-84731)
Vulnerability from cvelistv5 – Published: 2026-10-15 17:10 – Updated: 2026-10-15 19:14 X_Api Security X_Unauthenticated Access X_Prism Gateway X_Aos X_Pre Auth X_Rce
VLAI
EPSS
VEX
Title
Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
Summary
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CNA · Nutanix (v2.0.3)
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:29 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://download.nutanix.com/alerts/Security_Advi… | vendor-advisory |
| https://portal.nutanix.com/page/documents/list?ty… | release-notes |
| https://www.nutanix.com/support | x_support |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Nutanix | Acropolis Operating System (AOS) |
Affected:
0 , < 7.3.1.18
(custom)
Affected: 7.5 , < 7.5.2 (custom) Affected: 7.6 , < 7.6.0.8 (custom) cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:* cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:* cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 17:11
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:29:00.505460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:14:57.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Prism Gateway"
],
"product": "Acropolis Operating System (AOS)",
"vendor": "Nutanix",
"versions": [
{
"changes": [
{
"at": "7.3.1.18",
"status": "unaffected"
}
],
"lessThan": "7.3.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.5.2",
"status": "unaffected"
}
],
"lessThan": "7.5.2",
"status": "affected",
"version": "7.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.6.0.8",
"status": "unaffected"
}
],
"lessThan": "7.6.0.8",
"status": "affected",
"version": "7.6",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
}
],
"value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1.18",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.5.2",
"versionStartIncluding": "7.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.0.8",
"versionStartIncluding": "7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Brandon McGrath (mez-0)"
}
],
"datePublic": "2026-10-15T17:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\u003c/p\u003e\u003cp\u003eConsequently, the server responds with a \u003ccode\u003eSet-Cookie\u003c/code\u003e header containing a valid \u003ccode\u003eJSESSIONID\u003c/code\u003e. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\u003c/p\u003e"
}
],
"value": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-302",
"description": "CWE-302 Authentication bypass by Assumed-Immutable data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T17:10:29.432Z",
"orgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"shortName": "Nutanix"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf"
},
{
"tags": [
"release-notes"
],
"url": "https://portal.nutanix.com/page/documents/list?type=software\u0026filterKey=software\u0026filterVal=AOS"
},
{
"tags": [
"x_support"
],
"url": "https://www.nutanix.com/support"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade affected Nutanix AOS deployments to version\u0026nbsp;\u003cb\u003e7.3.1.18, 7.5.2, 7.6.0.8\u003c/b\u003e\u0026nbsp;or later fixed releases.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Upgrade affected Nutanix AOS deployments to version\u00a07.3.1.18, 7.5.2, 7.6.0.8\u00a0or later fixed releases."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_api-security",
"x_unauthenticated-access",
"x_prism-gateway",
"x_aos",
"x_pre-auth",
"x_rce"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-26T17:47:00.000Z",
"value": "Vulnerability reported to Nutanix via HackerOne"
},
{
"lang": "en",
"time": "2026-08-27T20:46:00.000Z",
"value": "Proof of concept validated."
},
{
"lang": "en",
"time": "2026-09-17T13:08:00.000Z",
"value": "Remediation verified across affected release branches."
},
{
"lang": "en",
"time": "2026-09-22T17:27:00.000Z",
"value": "Fix integrated into AOS maintenance releases."
},
{
"lang": "en",
"time": "2026-10-04T18:30:00.000Z",
"value": "AOS version 7.6.0.8 released."
},
{
"lang": "en",
"time": "2026-10-05T18:30:00.000Z",
"value": "AOS version 7.3.1.18 released."
},
{
"lang": "en",
"time": "2026-10-12T18:30:00.000Z",
"value": "AOS version 7.5.2 released."
},
{
"lang": "en",
"time": "2026-10-15T17:11:00.000Z",
"value": "Public security advisory and CVE published."
}
],
"title": "Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eOrganizations can mitigate this issue prior to patching by enforcing the following controls\u003c/span\u003e:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eNetwork Segmentation:\u003c/strong\u003e Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eIngress Traffic Filtering:\u003c/strong\u003e Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u003cspan\u003e\u0026nbsp;the cluster.\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003ci\u003eNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.\u003c/i\u003e\u003c/div\u003e"
}
],
"value": "Organizations can mitigate this issue prior to patching by enforcing the following controls:\n\n * Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\n\n * Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u00a0the cluster.\n\n\n\nNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"assignerShortName": "Nutanix",
"cveId": "CVE-2026-84731",
"datePublished": "2026-10-15T17:10:29.432Z",
"dateReserved": "2026-09-02T06:41:54.722Z",
"dateUpdated": "2026-10-15T19:14:57.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"modules": [
"Prism Gateway"
],
"product": "Acropolis Operating System (AOS)",
"vendor": "Nutanix",
"versions": [
{
"changes": [
{
"at": "7.3.1.18",
"status": "unaffected"
}
],
"lessThan": "7.3.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.5.2",
"status": "unaffected"
}
],
"lessThan": "7.5.2",
"status": "affected",
"version": "7.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.6.0.8",
"status": "unaffected"
}
],
"lessThan": "7.6.0.8",
"status": "affected",
"version": "7.6",
"versionType": "custom"
}
]
}
],
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks."
}
],
"id": "CVE-2026-84731",
"lastModified": "2026-10-15T20:17:15.097",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"type": "Secondary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"type": "Secondary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "PROOF_OF_CONCEPT",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"ssvcData": {
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CNA",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-84731",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:29:00.505460Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-15T18:17:29.960",
"references": [
{
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf"
},
{
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"url": "https://portal.nutanix.com/page/documents/list?type=software\u0026filterKey=software\u0026filterVal=AOS"
},
{
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"url": "https://www.nutanix.com/support"
}
],
"sourceIdentifier": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-290"
},
{
"lang": "en",
"value": "CWE-302"
},
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:29:00.505460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:11:37.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Prism Gateway"
],
"product": "Acropolis Operating System (AOS)",
"vendor": "Nutanix",
"versions": [
{
"changes": [
{
"at": "7.3.1.18",
"status": "unaffected"
}
],
"lessThan": "7.3.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.5.2",
"status": "unaffected"
}
],
"lessThan": "7.5.2",
"status": "affected",
"version": "7.5",
"versionType": "custom"
},
{
"changes": [
{
"at": "7.6.0.8",
"status": "unaffected"
}
],
"lessThan": "7.6.0.8",
"status": "affected",
"version": "7.6",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
}
],
"value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1.18",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.5.2",
"versionStartIncluding": "7.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.0.8",
"versionStartIncluding": "7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Brandon McGrath (mez-0)"
}
],
"datePublic": "2026-10-15T17:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\u003c/p\u003e\u003cp\u003eConsequently, the server responds with a \u003ccode\u003eSet-Cookie\u003c/code\u003e header containing a valid \u003ccode\u003eJSESSIONID\u003c/code\u003e. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\u003c/p\u003e"
}
],
"value": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-302",
"description": "CWE-302 Authentication bypass by Assumed-Immutable data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T17:10:29.432Z",
"orgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"shortName": "Nutanix"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf"
},
{
"tags": [
"release-notes"
],
"url": "https://portal.nutanix.com/page/documents/list?type=software\u0026filterKey=software\u0026filterVal=AOS"
},
{
"tags": [
"x_support"
],
"url": "https://www.nutanix.com/support"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade affected Nutanix AOS deployments to version\u0026nbsp;\u003cb\u003e7.3.1.18, 7.5.2, 7.6.0.8\u003c/b\u003e\u0026nbsp;or later fixed releases.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Upgrade affected Nutanix AOS deployments to version\u00a07.3.1.18, 7.5.2, 7.6.0.8\u00a0or later fixed releases."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_api-security",
"x_unauthenticated-access",
"x_prism-gateway",
"x_aos",
"x_pre-auth",
"x_rce"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-26T17:47:00.000Z",
"value": "Vulnerability reported to Nutanix via HackerOne"
},
{
"lang": "en",
"time": "2026-08-27T20:46:00.000Z",
"value": "Proof of concept validated."
},
{
"lang": "en",
"time": "2026-09-17T13:08:00.000Z",
"value": "Remediation verified across affected release branches."
},
{
"lang": "en",
"time": "2026-09-22T17:27:00.000Z",
"value": "Fix integrated into AOS maintenance releases."
},
{
"lang": "en",
"time": "2026-10-04T18:30:00.000Z",
"value": "AOS version 7.6.0.8 released."
},
{
"lang": "en",
"time": "2026-10-05T18:30:00.000Z",
"value": "AOS version 7.3.1.18 released."
},
{
"lang": "en",
"time": "2026-10-12T18:30:00.000Z",
"value": "AOS version 7.5.2 released."
},
{
"lang": "en",
"time": "2026-10-15T17:11:00.000Z",
"value": "Public security advisory and CVE published."
}
],
"title": "Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eOrganizations can mitigate this issue prior to patching by enforcing the following controls\u003c/span\u003e:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eNetwork Segmentation:\u003c/strong\u003e Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eIngress Traffic Filtering:\u003c/strong\u003e Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u003cspan\u003e\u0026nbsp;the cluster.\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003ci\u003eNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.\u003c/i\u003e\u003c/div\u003e"
}
],
"value": "Organizations can mitigate this issue prior to patching by enforcing the following controls:\n\n * Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\n\n * Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u00a0the cluster.\n\n\n\nNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
"assignerShortName": "Nutanix",
"cveId": "CVE-2026-84731",
"datePublished": "2026-10-15T17:10:29.432Z",
"dateReserved": "2026-09-02T06:41:54.722Z",
"dateUpdated": "2026-10-15T17:10:29.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.