CVE-2026-84731 Nutanix CVE debrief

Who should care

Nutanix Acropolis Operating System (AOS) administrators and users, security teams responsible for monitoring and patching vulnerabilities, and operators managing affected deployments. These roles are crucial in ensuring the secure configuration and operation of Nutanix AOS environments.

Why it matters

CVE-2026-84731 is a critical vulnerability in Nutanix Acropolis Operating System (AOS) that allows unauthenticated remote attackers to bypass authentication and gain full access to administrative API endpoints. This vulnerability can lead to severe consequences, including complete cluster destruction and unauthorized access to sensitive data. Affected roles and deployment contexts include Nutanix AOS administrators and users, as well as security teams responsible for monitoring and patching vulnerabilities. The evidence supporting this vulnerability is based on official CVE Program and NVD records, as well as vendor advisories.

• Potential for complete cluster destruction
• Unauthorized access to VM memory and virtual disks
• Elevation of privileges to execute root-level commands
• Bypass of authentication mechanisms

Technical summary

The vulnerability is caused by a misconfiguration in the application's authentication filters, which allows an attacker to obtain a valid JSESSIONID and gain maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks. The vulnerability affects Nutanix Acropolis Operating System (AOS) and can be mitigated by updating to version 7.3.1.18, 7.5.2, or 7.6.0.8, or later. It is also recommended to implement additional authentication and authorization measures for administrative API endpoints.

Defensive priority

High

Recommended defensive actions

• Review and update Nutanix Acropolis Operating System (AOS) versions to 7.3.1.18, 7.5.2, or 7.6.0.8, or later
• Implement additional authentication and authorization measures for administrative API endpoints
• Monitor cluster activity for suspicious behavior
• Restrict access to administrative API endpoints
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is caused by a misconfiguration in the application's authentication filters, which allows an attacker to obtain a valid JSESSIONID and gain maximum cluster administrative privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.