---
id: CVE-2026-84731
title: >-
  An unauthenticated remote attacker can bypass authentication and gain full
  access to administrative API endpoints in Nutanix Prism Element by including a
  crafted internal management HTTP header
summary: >-
  An unauthenticated remote attacker can bypass authentication and gain full
  access to administrative API endpoints in Nutanix Prism Element by including a
  crafted internal management HTTP header. The vulnerability is caused by a
  misconfig…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-290
  - CWE-302
  - CWE-306
vendor: Nutanix
product: Acropolis Operating System (AOS)
affected:
  - acropolis_operating_system_aos < 7.3.1.18
  - acropolis_operating_system_aos >= 7.5 < 7.5.2
  - acropolis_operating_system_aos >= 7.6 < 7.6.0.8
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:29.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84731'
references:
  - url: 'https://download.nutanix.com/alerts/Security_Advisory_0058.pdf'
    label: 2ffdacf6-8681-47df-b023-4f11abd61c1d
  - url: >-
      https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS
    label: 2ffdacf6-8681-47df-b023-4f11abd61c1d
  - url: 'https://www.nutanix.com/support'
    label: 2ffdacf6-8681-47df-b023-4f11abd61c1d
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T18:23:58.452Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T17:29:00.505460Z'
---

## Overview

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.



Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.