PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5944 Nutanix CVE debrief

An improper access control vulnerability in the Cisco Intersight Device Connector for Nutanix Prism Central exposes an unauthenticated API passthrough endpoint on TCP port 7373. The affected versions span 4.3.0 through 7.5.0. An unauthenticated attacker with network access can enumerate cluster metadata including virtual machine information and cluster configuration details, and may invoke certain cluster maintenance workflows. While the vulnerability does not permit persistent configuration changes or credential access, successful exploitation can disrupt active workloads and impact service availability. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, low confidentiality impact, no integrity impact, and high availability impact. The vulnerability was published on 2026-04-28 and last modified on 2026-05-18. No known exploitation in the wild has been confirmed (E:U in CVSS vector).

Vendor
Nutanix
Product
Cisco Intersight Device Connector for Prism Central
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-05-18
Advisory published
2026-04-28
Advisory updated
2026-05-18

Who should care

Organizations running Cisco Intersight Device Connector for Nutanix Prism Central versions 4.3.0-7.5.0, particularly those with network segments where TCP port 7373 is reachable by untrusted hosts. Infrastructure teams managing Nutanix Prism Central clusters and security teams responsible for network segmentation and access control validation.

Technical summary

The Cisco Intersight Device Connector for Nutanix Prism Central versions 4.3.0 through 7.5.0 exposes an API passthrough endpoint on TCP port 7373 without authentication. The endpoint allows read-only enumeration of cluster metadata and invocation of certain cluster maintenance workflows. Exploitation requires network access to the deployment environment. Impact is limited to availability disruption through workload interference; no persistent modification or credential access is possible.

Defensive priority

medium

Recommended defensive actions

  • Review network segmentation to restrict access to TCP port 7373 on affected Cisco Intersight Device Connector deployments
  • Apply vendor-provided patches or updates per Nutanix Security Advisory 0046
  • Monitor for unauthorized enumeration requests to the API passthrough endpoint
  • Validate that cluster maintenance workflows require appropriate authentication controls
  • Assess workload availability impact in environments where the connector is deployed

Evidence notes

Vulnerability description and CVSS scoring derived from NVD record. Affected version range confirmed via CPE criteria in source metadata. CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization) identified as associated weaknesses. Third-party advisory reference provided by Nutanix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5944 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5944

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5944 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5944

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://download.nutanix.com/alerts/Security_Advisory_0046.pdf

    2ffdacf6-8681-47df-b023-4f11abd61c1d - Third Party Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.nutanix.com/support

    2ffdacf6-8681-47df-b023-4f11abd61c1d - Product, Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.