Arbitrary Code Execution Vulnerability in Nutanix AOS and Prism Central

Nutanix has disclosed a critical security vulnerability affecting Nutanix AOS and Nutanix Prism Central that enables unauthenticated remote attackers to achieve arbitrary code execution with administrative privileges. By exploiting this flaw, an attacker can bypass existing security controls to gain full control over the affected infrastructure components. This vulnerability represents a significant risk to the confidentiality, integrity, and availability of managed environments. Organizations utilizing Nutanix AOS or Prism Central are urged to evaluate their exposure and apply security patches or mitigations provided by the vendor immediately to prevent unauthorized access and potential system compromise.

Impact

Successful exploitation of this vulnerability grants an attacker administrative-level access to Nutanix AOS or Prism Central environments. This allows for full compromise of the affected virtualization management infrastructure, potentially resulting in data exfiltration, lateral movement within the data center, and the disruption of critical business services managed by the Nutanix platform.

Recommendation

• Monitor vendor security channels for the release of security patches addressing this flaw in Nutanix AOS and Prism Central.
• Implement network segmentation to restrict access to Prism Central management interfaces to known, authorized administrative hosts only.
• Audit logs for unauthorized access attempts or suspicious management traffic targeting the AOS and Prism Central control planes.