Will CVE-2026-84731 Allow Attackers to Seize Full Administrative Control of Nutanix AOS Clusters via Crafted Headers?

The short version

• Attackers can bypass authentication in Nutanix Prism Element using a specific HTTP header.
• The server issues a valid session cookie containing a JWT with maximum privileges.
• This leads to root-level command execution on all Controller VMs in the affected cluster.

The details

An unauthenticated remote attacker can bypass authentication mechanisms in Nutanix Prism Element by including a crafted internal management HTTP header, according to the National Vulnerability Database. This vulnerability, identified as CVE-2026-84731, stems from a misconfiguration in the application's authentication filters. The flaw allows an attacker to gain full access to administrative API endpoints without providing valid credentials.

The server responds to the crafted request with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token that grants maximum cluster administrative privileges. Successful exploitation enables the attacker to execute root-level commands on all Controller VMs within the cluster. This access can lead to complete cluster destruction and unauthorised access to virtual machine memory and disks.

The context

The vulnerability affects Nutanix Acropolis Operating System versions before 7.3.1.18, before 7.5.2 and before 7.6.0.8. The NVD assigns a CVSS score of 9.3 to the issue, classifying it as critical. The weaknesses involved include CWE-306, CWE-290 and CWE-302. As Honeypot Daily reported on 2026-10-14, similar critical flaws have impacted other infrastructure components, highlighting the ongoing risk of authentication bypasses in complex systems.

Next steps

Organisations should immediately inventory their Nutanix environments to identify any instances running affected AOS versions. Teams must verify whether their clusters are exposed to unauthenticated network access. If an organisation is running a vulnerable version, they should prepare to upgrade to a patched release as soon as the vendor provides it. Until then, restricting network access to Prism Element management interfaces may reduce the attack surface.

What defenders should look for

Security teams should monitor for unusual authentication patterns, specifically successful logins from unexpected source IPs or without prior credential submission. Look for the sudden appearance of high-privilege session tokens or JWTs in web server logs. Check for outbound connections from Controller VMs to unknown external hosts, which may indicate data exfiltration or command-and-control activity. Inspect system logs for root-level command executions that do not correlate with scheduled maintenance or known administrative actions. If suspicious activity is detected, isolate the affected cluster segments to prevent lateral movement and preserve forensic evidence for analysis.

What to do and how to stay safe: Nutanix

• Audit network access controls to ensure Prism Element management interfaces are not exposed to untrusted networks.
• Monitor web server logs for requests containing unusual internal management headers or unexpected authentication bypasses.
• Verify the integrity of Controller VMs by checking for unknown processes or modified system files.
• Prepare an incident response plan that includes steps for isolating compromised clusters and preserving log data.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Nutanix versions are affected by CVE-2026-84731?

Versions of Nutanix Acropolis Operating System before 7.3.1.18, before 7.5.2 and before 7.6.0.8 are affected.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-84731 as critical with a CVSS score of 9.3.

Can an attacker gain root access through this flaw?

Yes, successful exploitation allows an attacker to execute root-level commands on all Controller VMs in the cluster.