CVE-2026-20321: Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to reach the web-based management API and authenticate with valid administrative credentials. Unauthenticated attackers are not described as able to exploit it.
What level of access could a successful attacker obtain?
Successful exploitation allows arbitrary command execution on the affected device's underlying operating system as the root user. This can affect confidentiality and integrity, while no availability impact is specified in the supplied severity vector.
What should defenders investigate first?
Review administrative API accounts and their credential exposure, because valid administrative credentials are required. Also examine management API activity for crafted or unusual command arguments and investigate any evidence of unexpected operating-system command execution.