CVE-2026-84731 is a pre-authentication break in the gateway behind Nutanix Prism Element, the local control plane embedded in a Nutanix cluster. AOS pools server compute and local storage into hyperconverged infrastructure, while Prism is where administrators configure, monitor and operate the cluster. That makes its management interface an unusually valuable target: it is not merely an application console, but a path into the systems running virtual machines, storage and networking.
A trusted-header check becomes an admin session
A remote attacker needs network connectivity to Prism’s management interface on TCP 9440, but no account or prior authentication. The gateway’s authentication filters incorrectly trust an internal management HTTP header. By sending a specially crafted request, an attacker can bypass validation and receive a Set-Cookie response containing a valid JSESSIONID.
That cookie is more than a browser session marker. Nutanix says it contains a JWT — a signed token used to convey identity and privileges — granting maximum cluster-administrator rights. The result is full access to Prism administrative APIs. The detailed CVE record says this can extend to root-level commands on Controller VMs (CVMs), access to VM memory and virtual disks, and potentially destruction of the cluster. The public record does not disclose the header name or value; Nutanix will provide it through Support to verified customers needing temporary ingress filtering.
Exposure follows the management network
Prism Element is run by the infrastructure teams operating Nutanix clusters: enterprise datacentres, private and hybrid clouds, edge deployments and the business workloads placed on them. That includes organisations in financial services, healthcare, government, education, manufacturing and telecommunications. A management port exposed beyond a tightly controlled administrative network turns this from a cluster-maintenance issue into a remotely reachable control-plane compromise.
There is a scope detail worth resolving in change planning. The vendor advisory lists both AOS/Prism Element and Prism Central, which centrally manages multiple clusters, with the same fixed releases. The CNA record names AOS’s Prism Gateway only. Public material does not settle whether Prism Central is formally in scope, so teams using it should obtain confirmation from Nutanix rather than assume exclusion.
Patch promptly, restrict access now
Fixed releases are AOS 7.3.1.18, 7.5.2 and 7.6.0.8; install the applicable release or later. The stated affected ranges are versions below 7.3.1.18, 7.5 before 7.5.2, and 7.6 before 7.6.0.8. The advisory does not definitively explain treatment of omitted branches, including 7.4, and its release dates differ from the CNA timeline. Verify the supported upgrade target with Nutanix.
Until patched, restrict TCP 9440 management access to trusted administrator networks. Do not improvise header filtering: Nutanix specifically warns against relying on it until compatibility is validated. A WAF or reverse proxy may be an interim option only with vendor guidance and the non-public header details.
Nutanix validated a privately submitted proof of concept during disclosure, but no public proof of concept, exploit code or automated toolkit had surfaced as of October 16, 2026. No exploitation in the wild or affected customer has been confirmed, and CVE-2026-84731 was not in CISA’s Known Exploited Vulnerabilities catalog as of that date. Still, this is the kind of flaw to treat as an exposure review and an upgrade task, not a backlog item. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs.
