CVE-2026-5944 Details

A vulnerability allowing improper access control has been identified in the Cisco Intersight Device Connector for Nutanix Prism Central. This issue arises because the service exposes an API passthrough endpoint on TCP port 7373, which is accessible within the deployment environment's network scope without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint, allowing them to enumerate cluster metadata, including virtual machine details and cluster configuration. While the API mainly supports read-only operations, it also enables certain cluster maintenance workflows. Although this vulnerability does not permit persistent changes to system configurations or access to credentials or sensitive user data, successful exploitation could disrupt active workloads, causing a loss of service availability in the affected environment.