Nutanix clusters face unauthenticated root takeover via critical Prism Element vulnerability CVE-2026-84731

Nutanix Acropolis Operating System (AOS) versions before 7.3.1.18, before 7.5.2, and before 7.6.0.8 are affected by a critical security flaw that exposes administrative interfaces to unauthenticated attackers. The National Vulnerability Database records this issue as CVE-2026-84731, assigning it a CVSS score of 9.3. This rating reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. The vulnerability stems from a misconfiguration in the application’s authentication filters within Nutanix Prism Element, the management interface for AOS clusters.

How it unfolded

• Attackers send a crafted internal management HTTP header to the vulnerable Prism Element interface to bypass standard authentication checks.
• The server processes this request and returns a Set-Cookie header containing a valid JSESSIONID token.
• This session cookie decodes into a JSON Web Token that grants maximum cluster administrative privileges to the attacker.
• With these privileges, the attacker can execute root-level commands on all Controller VMs, potentially destroying the cluster or accessing VM data.

Who is affected

Organizations running Nutanix AOS versions older than 7.3.1.18, 7.5.2, or 7.6.0.8 are directly at risk. The flaw allows complete bypass of authentication, meaning no valid credentials are required to exploit it. According to the NVD record, the underlying weaknesses involve missing authentication for critical functions and improper privilege management. Successful exploitation enables attackers to gain full access to administrative API endpoints. This access extends to root-level command execution on Controller VMs, which manage the storage and virtualization layer. Attackers can consequently read or modify virtual disk contents and VM memory, leading to total cluster compromise.

Our take on the response

The severity of this flaw lies in its unauthenticated nature and the depth of access it provides. As Patch Observer noted in recent reporting on critical infrastructure flaws, such as the Juniper Junos OS buffer overflow, immediate version checks are required for managed service providers. The ability to generate a valid administrative JWT through a simple HTTP header manipulation indicates a fundamental failure in input validation and session handling.

This suggests that network segmentation alone may not prevent exploitation if management interfaces are reachable. The impact mirrors high-severity database flaws, such as the SQL Server heap overflow reported in October 2026, where authorized users gained remote code execution, but here the barrier to entry is effectively zero.

Who needs to act first

Teams usually prioritize systems exposed to the internet or demilitarized zones when addressing unauthenticated remote code execution flaws. Check whether your Prism Element interfaces are accessible from untrusted networks before rolling out any changes. Verify current AOS versions against the affected list to identify exposed clusters immediately.

Back up configuration data and virtual machine states before applying any patches or configuration changes. Test updates in a non-production environment first to ensure stability. If immediate patching is not possible, restrict network access to management ports using strict firewall rules, allowing only trusted administrative IP addresses. Monitor logs for unusual authentication attempts or unexpected cookie generation.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: Nutanix

• Audit all Nutanix clusters to confirm they are running AOS 7.3.1.18, 7.5.2, or 7.6.0.8 or later.
• Restrict network access to Prism Element management ports to known administrative IP ranges only.
• Monitor server logs for requests containing unusual internal management HTTP headers.
• Review firewall rules to ensure external traffic cannot reach the Controller VMs directly.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-84731?

The National Vulnerability Database rates CVE-2026-84731 as Critical with a CVSS score of 9.3.

Which Nutanix AOS versions are vulnerable to this flaw?

Versions before 7.3.1.18, before 7.5.2, and before 7.6.0.8 are affected by this authentication bypass vulnerability.

How do attackers exploit this vulnerability?

Attackers include a crafted internal management HTTP header in requests to Prism Element to bypass authentication and obtain a valid administrative session cookie.