Acropolis Operating System Aos
Monthly
Unauthenticated attackers who can reach the Nutanix Prism Element management API can bypass authentication completely by sending an HTTP request with a crafted "internal management" header that the application's authentication filter trusts, and the server then issues a Set-Cookie response containing a valid JSESSIONID that decodes to a JWT carrying maximum cluster administrative privileges. Successful exploitation lets the attacker run root-level commands on every Controller VM (CVM) in the cluster and reach VM memory and virtual disks, resulting in total cluster compromise; the vulnerability is rated 9.3 with an independently assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and publicly available exploit code exists (the CVSS 4.0 vector rates exploit maturity as Proof-of-Concept), while no confirmed active exploitation (CISA KEV) has been identified and the decisive exposure factor is whether the Prism management plane is reachable from untrusted networks.
Unauthenticated attackers who can reach the Nutanix Prism Element management API can bypass authentication completely by sending an HTTP request with a crafted "internal management" header that the application's authentication filter trusts, and the server then issues a Set-Cookie response containing a valid JSESSIONID that decodes to a JWT carrying maximum cluster administrative privileges. Successful exploitation lets the attacker run root-level commands on every Controller VM (CVM) in the cluster and reach VM memory and virtual disks, resulting in total cluster compromise; the vulnerability is rated 9.3 with an independently assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and publicly available exploit code exists (the CVSS 4.0 vector rates exploit maturity as Proof-of-Concept), while no confirmed active exploitation (CISA KEV) has been identified and the decisive exposure factor is whether the Prism management plane is reachable from untrusted networks.