The version of AHV installed on the remote host is prior to 11.0.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.0.1 advisory.

  - Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local     attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`,     `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making     potentially recursive calls. When such functions were called recursively this could allow for uncontrolled     recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive     calls, allowing recursion depth to be controlled. (CVE-2025-9714)

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with only a slash as path (`path=/`). Since this site is not secure,     the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap     buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong     conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it     is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects     BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through     9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
    (CVE-2025-40780)

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.0.1)

medium Nessus Plugin ID 299030

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 15, 2026, 6:55 PM Plugin metadata Plugin Feed: 202609151855
Version 1.3 Jul 28, 2026, 3:13 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202607280313
Version 1.2 Jul 15, 2026, 11:41 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607152341
Version 1.1 Feb 14, 2026, 1:12 AM New Plugin Feed: 202602140112