Tip: Nutanix shops — patch AOS for CVE-2026-84731 and confirm Prism Element (9440) isn't reachable from user or internet networks
Upgrade to AOS 7.3.1.18, 7.5.2 or 7.6.0.8+. Until then, limit TCP 9440 to management VLANs or jump hosts, and if you front Prism with a proxy, open a Support case for the header string to strip. Because the bypass mints a real admin session, review Prism audit logs for admin API activity you can't tie to a known operator.
Sources: CVE record (Nutanix CNA) · Nutanix Security Advisory 0058