CVE-2026-84731

Vulnerability summary

Timeline

1. 2026-10-15
   PublishedVulnerability first disclosed.
2. 2026-10-15
   Last modifiedVulnerability information updated.

Description

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-302Authentication Bypass by Assumed-Immutable DataThe authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.