CVE-2026-5944

Katalog CVE

CVSS 8.2 · High EPSS 0,91%

Kerentanan Missing Authentication for Critical Function pada cisco intersight device connector. Skor CVSS 3.1 8.2 (High) menurut CNA.

Deskripsi (NVD)

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-862: Missing Authorization

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://download.nutanix.com/alerts/Security_Advisory_0046.pdf advisory pihak ketiga
• https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=Prism product · advisory pihak ketiga
• https://www.nutanix.com/support product · advisory pihak ketiga