This vulnerability (CVE-2026-5944) involves missing authentication for a critical function in the Cisco Intersight Device Connector for Nutanix Prism Central (version 4.3.0). The service exposes an API passthrough endpoint on TCP port 7373 without requiring authentication within the network scope. An unauthenticated attacker can exploit this to enumerate cluster metadata, including virtual machine and cluster configuration details, and invoke some cluster maintenance workflows. Although the API is primarily read-only, the ability to trigger maintenance workflows can disrupt active workloads. There is no indication of persistent system configuration modification or credential access. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with high impact on availability and confidentiality.

Successful exploitation allows an unauthenticated attacker with network access to gather cluster metadata and invoke certain maintenance workflows, potentially disrupting active workloads and causing loss of service availability. There is no impact on persistent system configuration, credential exposure, or sensitive user data. The medium severity rating reflects the potential for availability disruption within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the TCP port 7373 endpoint to trusted hosts only and monitor for unauthorized access attempts. Do not expose the Cisco Intersight Device Connector API endpoint beyond the trusted internal network. Follow vendor updates for any forthcoming patches or official mitigations.