The version of AOS installed on the remote host is prior to 7.5.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.12 advisory.

  - A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the     gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a     `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can     cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
    (CVE-2026-58016)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`     each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across     two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng     1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`     sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets     `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with     `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`     pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to     the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both     functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes     the issue. (CVE-2026-33416)

  - IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an     attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double     quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING.
    A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are     evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
    (CVE-2026-48962)

  - Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow. (CVE-2026-5450)

  - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user. (CVE-2026-41411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.12)

high Nessus Plugin ID 339203

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 7, 2026, 7:59 PM CVE (set "CVE" coverage to "CVE-2025-6170,CVE-2025-13151,CVE-2026-5435,CVE-2026-5450,CVE-2026-5928,CVE-2026-60147,CVE-2026-6238,CVE-2026-15308,CVE-2026-28390,CVE-2026-33416,CVE-2026-34986,CVE-2026-39829,CVE-2026-39830,CVE-2026-39832,CVE-2026-41254,CVE-2026-41411,CVE-2026-42508,CVE-2026-44431,CVE-2026-46917,CVE-2026-46968,CVE-2026-47010,CVE-2026-47021,CVE-2026-47027,CVE-2026-47059,CVE-2026-47063,CVE-2026-48864,CVE-2026-48962,CVE-2026-50229,CVE-2026-53404,CVE-2026-53434,CVE-2026-54369,CVE-2026-54370,CVE-2026-55276,CVE-2026-55955,CVE-2026-55956,CVE-2026-58016,CVE-2026-59083,CVE-2026-59084") CVSS metrics ("Cvssv4 supplemental" set to none) Plugin Feed: 202609071959
Version 1.3 Sep 3, 2026, 1:08 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber") Plugin Feed: 202609031308
Version 1.2 Sep 2, 2026, 11:39 PM Plugin metadata Plugin Feed: 202609022339
Version 1.1 Aug 25, 2026, 10:44 AM New Plugin Feed: 202608251044