Multiple vulnerabilities affecting Cisco Application Policy Infrastructure Controller (APIC)

Cisco Application Policy Infrastructure Controller (APIC) is the centralized control point for policy and management of networks based on the Cisco Application Centric Infrastructure (ACI) architecture. It allows you to automate the deployment, management and monitoring of network infrastructures. This system is affected by several vulnerabilities labeled as follows: CVE-2026-76498 (CVSS 9.8): This vulnerability arises from improper access control issues (CWE-284). Exploitation of this vulnerability could allow an unauthenticated attacker to access protected functions or resources and perform actions normally reserved for authorized users. CVE-2026-76499 (CVSS 9.8): This vulnerability is due to improper neutralization issues (CWE-707). Exploitation of this vulnerability would allow an unauthenticated malicious actor to inject malicious data or commands, insufficiently filtered by the system, in order to modify its behavior. CVE-2026-76500 (CVSS 9.8): This vulnerability results from issues with improper control of a resource throughout its lifecycle (CWE-664). Exploitation of this vulnerability would allow an unauthenticated malicious actor to exploit poor resource management (memory, sessions, files) in order to cause a denial of service or alter the state of the system.

• Cisco APIC, versions 5.2(1g) through 5.2(8i);
• Cisco APIC, releases 5.3(1d) through 5.3(2f);
• Cisco APIC, versions 6.0(1g) through 6.0(9f);
• Cisco APIC, versions 6.1(1f) through 6.1(5e);
• Cisco APIC, versions 6.2(1f) through 6.2(2e);