🚨 NUTANIX PATCHES CRITICAL PRISM AUTH BYPASS (CVE-2026-84731) GIVING UNAUTHENTICATED ADMIN ACCESS Nutanix published Security Advisory 0058 on Oct 15, 2026 for "Prism Auth Bypass" (CVE-2026-84731), rated Critical (CVSS 3.1 9.8 / CVSS 4.0 9.3). Key details: • A remote attacker who can reach the Prism management interface on port 9440 can send a specially crafted HTTP request header and get administrative access to Prism APIs without credentials • Nutanix lists impact as authentication bypass, privilege escalation and potential root-level remote code execution • Affected: AOS / Prism Element and Prism Central releases before the fixed versions • Nutanix does not report in-the-wild exploitation, and the CVE is not in CISA KEV Fixed: AOS and Prism Central 7.6.0.8 (Oct 6), 7.5.2 (Oct 13) and 7.3.1.18 (Oct 6). ⚠️ Analyst Note: Prism controls the whole hyperconverged cluster, so an exposed port 9440 is the main risk. Patch, keep Prism reachable only from trusted admin networks (Nutanix says not to rely on header filtering yet), and review Prism audit logs for admin activity you can't explain. Sources: https://download.nutanix.com/alerts/Security_Advisory_0058.pdf https://nvd.nist.gov/vuln/detail/CVE-2026-84731 #DDW #Nutanix #CVE #Vulnerability #CyberSecurity
