Auth bypass in Cisco Intersight Device Connector

CVE-2026-5944

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment.

Vulnerability class: Broken Authentication

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.

EPSS exploit prediction

EPSS: 0.009 (58.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-5944: held from 0.005 to 0.009.

EPSS over last 30 days · oldest: 0.005 · newest: 0.009 · change: +0.004

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-5944?
CVE-2026-5944 is a high-severity vulnerability in Cisco Intersight Device Connector, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-04-28.
How severe is CVE-2026-5944?
High severity. CVSS v3 base score is 8.2 out of 10.