# Cisco APIC patches multiple critical flaws

Published: 2026-10-09 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/a4b41623-a4d3-50c9-af70-75369e98b036/cisco-apic-patches-multiple-critical-flaws

> Cisco fixed five APIC vulnerabilities, three critical (CVSS 9.8) allowing authenticated attackers root-level command execution and privilege escalation.

NCSC-NL republished a Cisco security advisory covering multiple vulnerabilities in Cisco Application Policy Infrastructure Controller (APIC). The most severe issues stem from insufficient input validation in the web-based management API, which could allow an authenticated attacker with valid administrative credentials to execute arbitrary commands with root privileges. A separate flaw in the export policies functionality provides insufficient access protection, potentially allowing unauthorized access to sensitive files and privilege escalation to root level. Additional vulnerabilities relate to improper access control, improper input neutralization, and improper resource control, which could let an attacker bypass security controls or mismanage system resources.

Five CVEs were disclosed: CVE-2026-20321 and CVE-2026-76488 (CVSS 6.5), and CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 (CVSS 9.8, critical). Cisco has released software updates addressing all identified issues. There is no indication in this advisory of active exploitation in the wild; the primary action for defenders is to apply the vendor-supplied patches promptly, particularly given three vulnerabilities reach the critical severity threshold.

Defenders running Cisco APIC should prioritize patching, review administrative account access given that exploitation of the command injection flaw requires valid admin credentials, and audit export policy configurations for unauthorized file access. Full technical details and patch information are available via the linked Cisco Security Advisories.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20321, CVE-2026-76488, CVE-2026-76498, CVE-2026-76499, CVE-2026-76500

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0409.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a4b41623-a4d3-50c9-af70-75369e98b036/cisco-apic-patches-multiple-critical-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup