Nutanix's CVE record (Security Advisory 0058, Oct 15) says an unauthenticated attacker who adds a crafted internal-management HTTP header gets a valid JSESSIONID whose JWT carries full cluster-admin rights, allowing root commands on all Controller VMs and access to VM memory and disks. Fixed in AOS 7.3.1.18, 7.5.2 and 7.6.0.8. Interim mitigations: restrict Prism's TCP 9440 to management networks and strip the header at a WAF or reverse proxy; Nutanix gives the exact header only through Support. No exploitation reported so far.