Unauthenticated RCE Flaw in Nutanix Prism Element Grants Root Access to Clusters
A critical vulnerability in Nutanix Prism Element allows attackers to bypass authentication and execute root commands on virtualization clusters without valid credentials.
Key points
- CVE-2026-84731 carries a CVSS score of 9.3, classified as critical severity by the National Vulnerability Database.
- Exploitation requires no authentication, allowing remote attackers to gain full administrative access via crafted HTTP headers.
- The flaw affects Nutanix Acropolis Operating System versions prior to 7.3.1.18, 7.5.2, and 7.6.0.8.
Nutanix Prism Element contains a critical vulnerability that allows unauthenticated attackers to bypass security controls and gain full administrative access. The National Vulnerability Database records the flaw as CVE-2026-84731 with a CVSS score of 9.3. Attackers can exploit this issue by sending a crafted internal management HTTP header to the application.
At a glance
- CVE
- CVE-2026-84731
- Product
- Nutanix Acropolis Operating System (AOS)
- CVSS
- 9.3 Critical
- Weakness
- missing authentication
- Exploited
- No known exploitation
The vulnerability stems from a misconfiguration in the application's authentication filters, as noted by the NVD. This weakness enables remote attackers to access administrative API endpoints without providing valid credentials. The issue is linked to weaknesses CWE-306, CWE-290, and CWE-302, which relate to missing authentication and insufficient session management.
Technical Details of the Exploit
Successful exploitation results in the server responding with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token that grants maximum cluster administrative privileges to the attacker. That suggests the authentication logic fails to validate the origin or integrity of specific internal management headers.
With these elevated privileges, an attacker can execute root-level commands on all Controller VMs within the affected cluster. This access leads to complete cluster destruction and unauthorized access to virtual machine memory and virtual disks. The compromise affects the entire infrastructure managed by the compromised Prism Element instance.
Affected Software Versions
The National Vulnerability Database lists specific versions of Nutanix Acropolis Operating System as affected by this vulnerability. Users running AOS before version 7.3.1.18 are exposed to this risk. Additionally, versions prior to 7.5.2 and those before 7.6.0.8 are also vulnerable to unauthenticated remote code execution.
This incident follows other significant virtualization vulnerabilities reported recently. For example, Threat Times reported on October 15, 2026, that a critical server-side template injection flaw in SolusVM 2 allowed root code execution. Another report from the same date noted that AWS patched a remote code execution flaw in its Advanced JDBC Wrapper.
What should you do?
Organizations running affected versions of Nutanix Acropolis Operating System should immediately verify their current version status. Administrators must check for the presence of vulnerable AOS versions across their infrastructure. If a fix has been confirmed by the vendor, applying the update is the primary mitigation step.
What to do and how to stay safe: Nutanix
- Audit your Nutanix clusters to identify any instances running AOS versions before 7.3.1.18, 7.5.2, or 7.6.0.8.
- Review network logs for unexpected or crafted internal management HTTP headers targeting Prism Element administrative endpoints.
- Monitor Controller VMs for unusual root-level command execution or unexpected changes to virtual disk configurations.
- Implement strict network segmentation to limit external access to administrative API endpoints until a patch is applied.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-84731?
The vulnerability has a CVSS score of 9.3, which is classified as critical severity.
Which software versions are affected by this vulnerability?
Nutanix Acropolis Operating System versions before 7.3.1.18, before 7.5.2, and before 7.6.0.8 are affected.
Can this vulnerability be exploited remotely without authentication?
Yes, an unauthenticated remote attacker can exploit this flaw by including a crafted internal management HTTP header.
