Nutanix Prism Element EUVD-2026-102206

Exploitation requires network access to the Prism Element management/API interface and the ability to send an HTTP request containing a crafted 'internal management' header that the application's authentication filter incorrectly trusts from external callers; this misconfiguration appears to affect default authentication-filter behavior rather than an opt-in feature. No authentication is required (PR:N), no user interaction is needed (UI:N), and no special client-side configuration is required. The primary limiting factor is exposure of the Prism Element management plane: clusters whose management interface is segmented onto an isolated administrative network and not reachable by the attacker are not exploitable remotely, so network segmentation of the CVM/Prism management VLAN is the key mitigating control pending patching.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and the technical impact is maximal across both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with CWE-306 (Missing Authentication) yielding root on all CVMs and compromise of hosted guest VMs. The CVSS threat metric E:P indicates Proof-of-Concept exploit maturity, which aligns with the precision guidance that publicly available exploit code exists, though no independent public exploit was supplied in this intelligence set. No EPSS score and no CISA KEV entry were provided, so I cannot confirm active in-the-wild exploitation; the absence of KEV combined with E:P suggests the exploit is demonstrable but not yet documented as mass-exploited. Signals are largely consistent (vendor-reported, maximal impact, trivial access), so the main uncertainty is temporal (how imminent widespread exploitation is), not whether the flaw is real. EPSS is missing, so quantitative exploitation probability is unavailable - treat this as emergency-patch class based on impact and exploitability alone.

A remote attacker with network reachability to a cluster's Prism Element management interface sends an HTTP request to an administrative API endpoint while injecting a crafted internal management header that the misconfigured authentication filter trusts. The server returns a Set-Cookie JSESSIONID that decodes to a JWT with maximum cluster-admin privileges, which the attacker replays to run root-level commands on every Controller VM. The CVSS threat metric (E:P) indicates Proof-of-Concept maturity, and the AV:N/AC:L/PR:N/UI:N profile means no authentication, no victim interaction, and low effort are required.