The version of AHV installed on the remote host is prior to AHV-10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3 advisory.

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3)

high Nessus Plugin ID 240537

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Apr 30, 2026, 3:55 AM CISA reference Plugin Feed: 202604300355
Version 1.3 Apr 29, 2026, 12:50 PM CVE (set "CVE" coverage to "CVE-2020-11023,CVE-2022-49043,CVE-2024-1488,CVE-2024-24786,CVE-2024-3596,CVE-2024-4032,CVE-2024-5535,CVE-2024-55549,CVE-2024-5742,CVE-2024-6232,CVE-2024-6923,CVE-2024-8176,CVE-2024-8508,CVE-2024-9143,CVE-2025-0395,CVE-2024-10041,CVE-2024-10963,CVE-2024-11187,CVE-2024-12087,CVE-2024-12088,CVE-2024-12133,CVE-2024-12243,CVE-2024-12747,CVE-2024-42472,CVE-2024-45490,CVE-2024-45491,CVE-2024-45492,CVE-2024-50602,CVE-2024-56171,CVE-2024-56326,CVE-2025-24528,CVE-2025-24855,CVE-2025-24928,CVE-2025-27363") CVSS metrics ("Cvssv4 score" set to 8.2) CVSS metrics ("Cvssv4 supplemental" set to none) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N") CVSSv3 score source (changed from "CVE-2024-45492" to "CVE-2024-56171") Plugin metadata Plugin Feed: 202604291250
Version 1.2 Jun 27, 2025, 1:56 AM CEA reference Plugin Feed: 202506270156
Version 1.1 Jun 26, 2025, 10:02 AM New Plugin Feed: 202506261002