---
title: Nutanix Prism CVE-2026-84731: crafted internal header gives unauthenticated cluster admin and root on every CVM (CVSS 9.8) | ctxsec
url: https://ctxsec.com/items/nutanix-prism-cve-2026-84731
description: ""
status: "vendor advisory (not known exploited)"
published: 2026-10-17
---

> 

[← Cybersecurity News](/news) · [markdown](/items/nutanix-prism-cve-2026-84731.md)

vendor advisory (not known exploited)

2026-10-17

### Nutanix Prism CVE-2026-84731: crafted internal header gives unauthenticated cluster admin and root on every CVM (CVSS 9.8)

Nutanix's CVE record (Security Advisory 0058, Oct 15) says an unauthenticated attacker who adds a crafted internal-management HTTP header gets a valid JSESSIONID whose JWT carries full cluster-admin rights, allowing root commands on all Controller VMs and access to VM memory and disks. Fixed in AOS 7.3.1.18, 7.5.2 and 7.6.0.8. Interim mitigations: restrict Prism's TCP 9440 to management networks and strip the header at a WAF or reverse proxy; Nutanix gives the exact header only through Support. No exploitation reported so far.

Sources: [CVE record (Nutanix CNA)](https://www.cve.org/CVERecord?id=CVE-2026-84731) · [Nutanix Security Advisory 0058](https://download.nutanix.com/alerts/Security_Advisory_0058.pdf)