As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables.To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Cisco NX-OS SoftwareCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco NX-OS Software Security Hardening Release: October 2026CVE-2026-76455CVE-2026-76456CVE-2026-76457CVE-2026-76459CVE-2026-76458CVE-2026-76453Critical9.8Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution VulnerabilityCVE-2026-76465Critical9.8Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution VulnerabilitiesCVE-2026-76485CVE-2026-76486CVE-2026-76501Critical9.8Cisco NX-OS Software NX-API Remote Code Execution VulnerabilityCVE-2026-76471Critical9.8Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass VulnerabilityCVE-2026-20038Medium5.8Cisco NX-OS Software Control Plane Denial of Service VulnerabilityCVE-2026-20173Medium5.8Cisco NX-OS Software Python Sandbox Escape VulnerabilityCVE-2026-20032Medium4.4Cisco Application Policy Infrastructure ControllerCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco Application Policy Infrastructure Controller Security Hardening Release: October 2026CVE-2026-76499CVE-2026-76500CVE-2026-76498Critical9.8Cisco Application Policy Infrastructure Controller API Command Injection VulnerabilityCVE-2026-20321Medium6.5Cisco Application Policy Infrastructure Controller Unauthorized File Access VulnerabilityCVE-2026-76488Medium6.5Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and FinesseCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026CVE-2026-76480CVE-2026-76482CVE-2026-76483CVE-2026-76484Critical10.0Cisco License (Smart Software Manager) On-Prem VulnerabilitiesCVE-2026-76437CVE-2026-76452CVE-2026-20328CVE-2026-76454Critical10.0Cisco Meraki Security Hardening Release: October 2026CVE-2026-76470CVE-2026-76472CVE-2026-76469CVE-2026-76464CVE-2026-76467CVE-2026-76468CVE-2026-76463Critical9.6Cisco Finesse Server-Side Request Forgery VulnerabilityCVE-2026-20362High7.2
A vulnerability in the out of band (OOB) management interface IP table rule programming for Cisco Application Policy Infrastructure Controller (APIC) could allow an unauthenticated, remote attacker to bypass configured deny entries for specific IP ports. These IP ports would be permitted to the OOB management interface when, in fact, the packets should be dropped. The vulnerability is due to the configuration of specific IP table entries for which there is a programming logic error that results in the IP port being permitted. An attacker could exploit this vulnerability by sending traffic to the OOB management interface on the targeted device. A successful exploit could allow the attacker to bypass configured IP table rules to drop specific IP port traffic. The attacker has no control over the configuration of the device itself. This vulnerability affects Cisco APIC releases prior to the first fixed software Release 4.2(3j).
A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have valid user credentials and any role that includes CLI access. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by issuing crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the
A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)
A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the account is assigned. The attacker will be granted the privileges of the last user to log in, regardless of whether those privileges are higher or lower than what should have been granted. The attacker cannot gain root-level privileges. The vulnerability is due to a limitation with how Role-Based Access Control (RBAC) grants privileges to remotely authenticated users when login occurs via SSH directly to the local management interface of the APIC. An attacker could exploit this vulnerability by authenticating to the targeted device. The attacker's privilege level will be modified to match that of the last user to log in via SSH. An exploit could allow the attacker to gain elevated privileges and perform CLI commands that should be restricted by the attacker's configured role. Cisco Bug IDs: CSCvc34335. Known Affected Releases: 1.0(1e), 1.0(1h), 1.0(1k), 1.0(1n), 1.0(2j), 1.0(2m), 1.0(3f), 1.0(3i), 1.0(3k), 1.0(3n), 1.0(4h), 1.0(4o); 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1).
The installation component on Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.3(2f) mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCuz72347.