CVE-2026-5944: Cisco Intersight Auth Bypass Vulnerability

CVE-2026-5944 Overview

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication.

An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked.

Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.

Critical Impact

Unauthenticated network access to API endpoint enables cluster metadata enumeration and potential disruption of active workloads, resulting in loss of service availability.

Affected Products

• Cisco Intersight Device Connector for Nutanix Prism Central
• Nutanix Prism Central deployments with exposed TCP port 7373

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-5944 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-5944

Vulnerability Analysis

This vulnerability is classified as CWE-306: Missing Authentication for Critical Function. The core issue stems from the Cisco Intersight Device Connector exposing an API passthrough endpoint on TCP port 7373 without implementing proper authentication controls. This endpoint is accessible to any attacker with network access to the deployment environment.

The vulnerability allows unauthenticated users to interact with the API to enumerate sensitive cluster metadata, including virtual machine configurations and cluster details. More critically, while the API is primarily designed for read-only operations, certain cluster maintenance workflows can also be invoked by an attacker, potentially causing service disruptions.

The impact is primarily on availability, as successful exploitation can lead to disruption of active workloads. Confidentiality impact is limited to cluster metadata exposure, while integrity impact is minimal since persistent configuration changes are not possible through this attack vector.

Root Cause

The root cause of this vulnerability is the absence of authentication mechanisms on the API passthrough endpoint exposed by the Cisco Intersight Device Connector. The service binds to TCP port 7373 and accepts requests from any network-accessible client without validating credentials or implementing access controls. This design flaw allows any user with network access to interact with the API, bypassing intended security boundaries.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the affected Nutanix Prism Central deployment environment. The exploitation does not require any user interaction or prior authentication.

An attacker can exploit this vulnerability by:

1. Identifying exposed TCP port 7373 within the target network environment
2. Sending crafted HTTP/API requests to the passthrough endpoint
3. Enumerating cluster metadata including VM information and configuration details
4. Invoking cluster maintenance workflows to disrupt active workloads

The attack can be executed remotely from anywhere within the network scope of the deployment, making it accessible to both internal network actors and potentially external attackers if the port is exposed to untrusted networks.

Detection Methods for CVE-2026-5944

Indicators of Compromise

• Unexpected network connections to TCP port 7373 from unauthorized IP addresses
• Unusual API request patterns to the Intersight Device Connector endpoint
• Anomalous cluster metadata query activity or maintenance workflow invocations
• Service availability issues or workload disruptions correlating with suspicious network activity

Detection Strategies

• Monitor network traffic to TCP port 7373 for connections from non-management IP addresses
• Implement network segmentation monitoring to detect lateral movement toward Prism Central infrastructure
• Deploy intrusion detection signatures for unauthorized API access patterns to the Device Connector
• Review authentication logs for the absence of expected authentication events preceding API activity

Monitoring Recommendations

• Enable detailed logging on the Nutanix Prism Central cluster for API access events
• Configure SIEM alerts for connections to TCP port 7373 from unexpected source addresses
• Monitor for cluster maintenance workflow invocations outside of scheduled maintenance windows
• Implement endpoint detection and response (EDR) monitoring on systems hosting the Device Connector

How to Mitigate CVE-2026-5944

Immediate Actions Required

• Restrict network access to TCP port 7373 using firewall rules to allow only authorized management hosts
• Implement network segmentation to isolate Nutanix Prism Central infrastructure from untrusted network segments
• Review current network exposure and identify any systems with unnecessary access to the vulnerable endpoint
• Monitor for signs of exploitation while awaiting vendor patches

Patch Information

Refer to the Nutanix Security Advisory #0046 for official patch information and remediation guidance. Additional software documentation is available through the Nutanix Prism Software Documentation portal. For further assistance, contact the Nutanix Support Portal.

Workarounds

• Implement strict firewall rules to block access to TCP port 7373 from all non-essential network segments
• Deploy network-level access control lists (ACLs) to restrict connectivity to the API passthrough endpoint
• Consider disabling the Cisco Intersight Device Connector if Intersight integration is not actively required
• Place the Prism Central infrastructure in an isolated management VLAN with restricted access policies

# Example: Firewall rule to restrict TCP 7373 access (Linux iptables)
# Allow only from authorized management subnet
iptables -A INPUT -p tcp --dport 7373 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7373 -j DROP