The version of AHV installed on the remote host is prior to 11.0.1 / AHV-11.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1 advisory.

  - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages     to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized     cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code,     resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead     to undefined behavior, including compromised data confidentiality and integrity or crashes.
    (CVE-2025-5987)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path=\/\,`). Since this site is not     secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside     a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the     wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1)

medium Nessus Plugin ID 303851

Version 1.3

Version 1.2

Version 1.3 Jul 15, 2026, 11:41 PM CVSS metrics ("CVSSv2 score" set to 4.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P") CVSSv2 severity (based on CVE-2025-5318, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607152341
Version 1.2 Mar 27, 2026, 2:12 PM CVSS metrics ("CVSSv2 score" set to 8.5. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C") CVSSv2 score source (changed from "CVE-2025-11083" to "CVE-2025-5318") CVSSv2 severity (based on CVE-2025-5318, severity increased from "Medium" to "High") New Plugin Feed: 202603271412