Vulnerability-Lookup

GHSA-RJ7H-W2V7-V863

Vulnerability from github – Published: 2026-10-15 18:32 – Updated: 2026-10-15 18:32

Details

Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-84731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-15T18:17:29Z",
    "severity": "CRITICAL"
  },
  "details": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.",
  "id": "GHSA-rj7h-w2v7-v863",
  "modified": "2026-10-15T18:32:45Z",
  "published": "2026-10-15T18:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84731"
    },
    {
      "type": "WEB",
      "url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf"
    },
    {
      "type": "WEB",
      "url": "https://portal.nutanix.com/page/documents/list?type=software\u0026filterKey=software\u0026filterVal=AOS"
    },
    {
      "type": "WEB",
      "url": "https://www.nutanix.com/support"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-84731 (GCVE-0-2026-84731)

Vulnerability from cvelistv5 – Published: 2026-10-15 17:10 – Updated: 2026-10-15 19:14 X_Api Security X_Unauthenticated Access X_Prism Gateway X_Aos X_Pre Auth X_Rce

Title

Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

Summary

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CNA · Nutanix (v2.0.3)

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 17:29 UTC

CWE

CWE-306 - Missing authentication for critical function
CWE-290 - Authentication bypass by spoofing
CWE-302 - Authentication bypass by Assumed-Immutable data

Assigner

Nutanix CNA under the mitre root

CNA scorecard – unranked: 2 records in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://download.nutanix.com/alerts/Security_Advi…	vendor-advisory
https://portal.nutanix.com/page/documents/list?ty…	release-notes
https://www.nutanix.com/support	x_support

Impacted products

1 product

Vendor	Product	Version
Nutanix	Acropolis Operating System (AOS)	Affected: 0 , < 7.3.1.18 (custom) Affected: 7.5 , < 7.5.2 (custom) Affected: 7.6 , < 7.6.0.8 (custom) cpe:2.3:a:nutanix:aos_:::::::: cpe:2.3:a:nutanix:aos_:::::::: cpe:2.3:a:nutanix:aos_::::::::

Date Public

2026-10-15 17:11

Credits

Brandon McGrath (mez-0)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84731",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T17:29:00.505460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T19:14:57.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Prism Gateway"
          ],
          "product": "Acropolis Operating System (AOS)",
          "vendor": "Nutanix",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.3.1.18",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.3.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "7.5.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.5.2",
              "status": "affected",
              "version": "7.5",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "7.6.0.8",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.6.0.8",
              "status": "affected",
              "version": "7.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
            }
          ],
          "value": "The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.1.18",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.5.2",
                  "versionStartIncluding": "7.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nutanix:aos_:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.0.8",
                  "versionStartIncluding": "7.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Brandon McGrath (mez-0)"
        }
      ],
      "datePublic": "2026-10-15T17:11:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\u003c/p\u003e\u003cp\u003eConsequently, the server responds with a \u003ccode\u003eSet-Cookie\u003c/code\u003e header containing a valid \u003ccode\u003eJSESSIONID\u003c/code\u003e. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.\u003c/p\u003e"
            }
          ],
          "value": "An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application\u0027s authentication filters.\n\n\n\nConsequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eProof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "NONE",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "poc"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CNA",
              "version": "2.0.3"
            },
            "type": "ssvc"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing authentication for critical function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-302",
              "description": "CWE-302 Authentication bypass by Assumed-Immutable data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T17:10:29.432Z",
        "orgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
        "shortName": "Nutanix"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://download.nutanix.com/alerts/Security_Advisory_0058.pdf"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://portal.nutanix.com/page/documents/list?type=software\u0026filterKey=software\u0026filterVal=AOS"
        },
        {
          "tags": [
            "x_support"
          ],
          "url": "https://www.nutanix.com/support"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade affected Nutanix AOS deployments to version\u0026nbsp;\u003cb\u003e7.3.1.18, 7.5.2, 7.6.0.8\u003c/b\u003e\u0026nbsp;or later fixed releases.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Upgrade affected Nutanix AOS deployments to version\u00a07.3.1.18, 7.5.2, 7.6.0.8\u00a0or later fixed releases."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_api-security",
        "x_unauthenticated-access",
        "x_prism-gateway",
        "x_aos",
        "x_pre-auth",
        "x_rce"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-26T17:47:00.000Z",
          "value": "Vulnerability reported to Nutanix via HackerOne"
        },
        {
          "lang": "en",
          "time": "2026-08-27T20:46:00.000Z",
          "value": "Proof of concept validated."
        },
        {
          "lang": "en",
          "time": "2026-09-17T13:08:00.000Z",
          "value": "Remediation verified across affected release branches."
        },
        {
          "lang": "en",
          "time": "2026-09-22T17:27:00.000Z",
          "value": "Fix integrated into AOS maintenance releases."
        },
        {
          "lang": "en",
          "time": "2026-10-04T18:30:00.000Z",
          "value": "AOS version 7.6.0.8 released."
        },
        {
          "lang": "en",
          "time": "2026-10-05T18:30:00.000Z",
          "value": "AOS version 7.3.1.18 released."
        },
        {
          "lang": "en",
          "time": "2026-10-12T18:30:00.000Z",
          "value": "AOS version 7.5.2 released."
        },
        {
          "lang": "en",
          "time": "2026-10-15T17:11:00.000Z",
          "value": "Public security advisory and CVE published."
        }
      ],
      "title": "Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eOrganizations can mitigate this issue prior to patching by enforcing the following controls\u003c/span\u003e:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eNetwork Segmentation:\u003c/strong\u003e Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eIngress Traffic Filtering:\u003c/strong\u003e Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u003cspan\u003e\u0026nbsp;the cluster.\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e\u003ci\u003eNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.\u003c/i\u003e\u003c/div\u003e"
            }
          ],
          "value": "Organizations can mitigate this issue prior to patching by enforcing the following controls:\n\n  *  Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.\n\n  *  Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach\u00a0the cluster.\n\n\n\nNote on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2ffdacf6-8681-47df-b023-4f11abd61c1d",
    "assignerShortName": "Nutanix",
    "cveId": "CVE-2026-84731",
    "datePublished": "2026-10-15T17:10:29.432Z",
    "dateReserved": "2026-09-02T06:41:54.722Z",
    "dateUpdated": "2026-10-15T19:14:57.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted