Home

Description

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.

PUBLISHED Reserved 2026-04-09 | Published 2026-04-28 | Updated 2026-04-28 | Assigner Nutanix




MEDIUM: 6.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:C/RE:L/U:Amber

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

8.5AV:N/AC:L/Au:N/C:P/I:N/A:C

Problem types

CWE-306 Missing authentication for critical function

CWE-862 Missing Authorization

Product status

Default status
unaffected

4.3.0 (custom) before 7.5.1
affected

Timeline

2026-04-08:Initial vulnerability analysis and internal update
2026-04-08:CVE reserved
2026-04-28:Advisory published

Credits

External Security Researcher (via Cisco) reporter

References

download.nutanix.com/alerts/Security_Advisory_0046.pdf vendor-advisory

portal.nutanix.com/...are&filterKey=software&filterVal=Prism release-notes

www.nutanix.com/support

cve.org (CVE-2026-5944)

nvd.nist.gov (CVE-2026-5944)

Download JSON