Detections
Analytics
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)
critical Nessus Plugin ID 328839
Synopsis
The Nutanix AOS host is affected by multiple vulnerabilities .Description
The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.- NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep- copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure. (CVE-2026-33278)
- A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)
- A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)
- Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on.
Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)
- Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on.
Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the Nutanix AOS software to the recommended version. Before upgrading: if this cluster is registered with Prism Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product Interoperability page on the Nutanix portal.See Also
Plugin Details
Severity: Critical
ID: 328839
File Name: nutanix_NXSA-AOS-7_6.nasl
Version: 1.1
Type: Local
Family: Misc.
Published: 7/21/2026
Updated: 7/21/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
Percentile: 99.86
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2025-11083
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
CVSS Score Source: CVE-2026-33278
CVSS v4
Risk Factor: Critical
Base Score: 10
Threat Score: 10
Threat Vector: CVSS:4.0/E:A
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score Source: CVE-2026-33278
Vulnerability Information
CPE: cpe:/o:nutanix:aos
Required KB Items: Host/Nutanix/Data/lts, Host/Nutanix/Data/Service, Host/Nutanix/Data/Version, Host/Nutanix/Data/arch
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/21/2026
Vulnerability Publication Date: 9/26/2023
CISA Known Exploited Vulnerability Due Dates: 5/15/2026
Reference Information
CVE: CVE-2023-40403, CVE-2024-12086, CVE-2024-33655, CVE-2024-45777, CVE-2024-5642, CVE-2025-11083, CVE-2025-11187, CVE-2025-11411, CVE-2025-12084, CVE-2025-13601, CVE-2025-14017, CVE-2025-14087, CVE-2025-14104, CVE-2025-14512, CVE-2025-14819, CVE-2025-14831, CVE-2025-15281, CVE-2025-15366, CVE-2025-15367, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-40778, CVE-2025-40780, CVE-2025-45582, CVE-2025-4598, CVE-2025-47906, CVE-2025-48913, CVE-2025-53905, CVE-2025-53906, CVE-2025-58436, CVE-2025-59375, CVE-2025-6069, CVE-2025-6075, CVE-2025-61662, CVE-2025-61726, CVE-2025-6176, CVE-2025-61915, CVE-2025-61984, CVE-2025-61985, CVE-2025-64720, CVE-2025-65018, CVE-2025-66199, CVE-2025-66293, CVE-2025-68160, CVE-2025-68615, CVE-2025-68973, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2025-6965, CVE-2025-8291, CVE-2025-8677, CVE-2025-9086, CVE-2025-9230, CVE-2025-9615, CVE-2025-9714, CVE-2026-0861, CVE-2026-0865, CVE-2026-0915, CVE-2026-0994, CVE-2026-1299, CVE-2026-1519, CVE-2026-2100, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-22695, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-22795, CVE-2026-22796, CVE-2026-22801, CVE-2026-2291, CVE-2026-23865, CVE-2026-25646, CVE-2026-25749, CVE-2026-27135, CVE-2026-28390, CVE-2026-28417, CVE-2026-28421, CVE-2026-29111, CVE-2026-3039, CVE-2026-31431, CVE-2026-31790, CVE-2026-33278, CVE-2026-33412, CVE-2026-33416, CVE-2026-33636, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-34268, CVE-2026-34282, CVE-2026-34477, CVE-2026-34480, CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500, CVE-2026-3497, CVE-2026-34982, CVE-2026-35177, CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-35535, CVE-2026-39979, CVE-2026-40164, CVE-2026-40355, CVE-2026-40356, CVE-2026-4046, CVE-2026-41035, CVE-2026-4111, CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42944, CVE-2026-42959, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-4424, CVE-2026-4437, CVE-2026-4438, CVE-2026-45186, CVE-2026-4519, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-4786, CVE-2026-4878, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893, CVE-2026-5121, CVE-2026-5201, CVE-2026-5946, CVE-2026-6100, CVE-2026-6276, CVE-2026-6429, CVE-2026-7168, CVE-2026-7383, CVE-2026-9076