IT SBIT Services
Schneeberger
DEEN
CVE tracker

Nutanix AOS: Authentication bypass and remote code execution in Prism Gateway

CVE-2026-84731Critical 9.3

← All vulnerabilities

Summary

Nutanix AOS contains a pre-authentication admin bypass in the Prism Gateway component, which is part of Prism Element. An unauthenticated remote attacker who can reach the Prism Element management interface can send a crafted internal management HTTP header, receive a valid session cookie with maximum cluster administrative rights, and run root-level commands on all Controller VMs. Successful exploitation can lead to cluster destruction and access to VM memory and virtual disks. The CNA states that the exposure occurs when port 9440 is reachable from the public internet or an untrusted network without a firewall.

Affected

  • Nutanix AOS earlier than 7.3.1.18
  • Nutanix AOS 7.5.x earlier than 7.5.2
  • Nutanix AOS 7.6.x earlier than 7.6.0.8
  • Prism Central: Unknown.

Fixed in

  • AOS 7.3.1.18
  • AOS 7.5.2
  • AOS 7.6.0.8
  • Or later fixed releases.

Workaround

  • Restrict access to the Prism Element management port (9440) to dedicated management VLANs, jump boxes or authorised IP ranges.
  • Strip the internal management header at upstream WAFs or reverse proxies. This is a stopgap only.
  • Nutanix Support can provide the exact header string to verified existing customers who cannot patch immediately.

Exploitation

  • Proof-of-concept exploitation was validated during responsible disclosure.
  • No public exploit code or automated attack toolkit is known.
  • Not listed in CISA KEV. CISA SSVC exploitation value: none. Automatable: yes. Technical impact: total.
  • EPSS about 1.3% at the time of the sources.

Our recommendation

  • Patch AOS to 7.3.1.18, 7.5.2, 7.6.0.8 or later, prioritising any cluster with a Prism interface reachable from untrusted networks.
  • Immediately remove direct internet access to port 9440 and restrict it to admin networks.
  • Do not rely on header filtering alone.
  • Check Prism audit logs for unexplained administrative activity.
  • Verify the Prism Central version against the Nutanix advisory.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:35.

Original description (NVD)

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed