CVEvulnerability

CVE-2026-84731

9.3 CRITICAL Published 2026-10-15 Modified 2026-10-16 Official page ↗
Status
Awaiting Analysis
Published
2026-10-15
Last modified
2026-10-16
Assigner
2ffdacf6-8681-47df-b023-4f11abd61c1d
CVSS 4.0 (2ffdacf6-8681-47df-b023-4f11abd61c1d)
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Red
CVSS 3.1 (2ffdacf6-8681-47df-b023-4f11abd61c1d)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 (2ffdacf6-8681-47df-b023-4f11abd61c1d)
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-290, CWE-302, CWE-306

Description

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

Related

Weakness · CWE (3)

  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-302 Authentication Bypass by Assumed-Immutable Data weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References