Cisco Application Policy Infrastructure Controller up to 6.2(2e) neutralization

Summaryinfo

A vulnerability categorized as very critical has been discovered in Cisco Application Policy Infrastructure Controller. Affected by this issue is some unknown functionality. Executing a manipulation can lead to neutralization. This vulnerability appears as CVE-2026-76499. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in Cisco Application Policy Infrastructure Controller. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a neutralization vulnerability. The CWE definition for the vulnerability is CWE-707. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.  

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2026-76499 since 08/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/07/2026).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Application Policy Infrastructure Controller

Version

• 5.2(1g)
• 5.2(2e)
• 5.2(2f)
• 5.2(2g)
• 5.2(2h)
• 5.2(3e)
• 5.2(3f)
• 5.2(3g)
• 5.2(4d)
• 5.2(4e)
• 5.2(4f)
• 5.2(4h)
• 5.2(5c)
• 5.2(5d)
• 5.2(5e)
• 5.2(6e)
• 5.2(6g)
• 5.2(6h)
• 5.2(7f)
• 5.2(7g)
• 5.2(8d)
• 5.2(8e)
• 5.2(8f)
• 5.2(8g)
• 5.2(8h)
• 5.2(8i)
• 5.3(1d)
• 5.3(2a)
• 5.3(2b)
• 5.3(2c)
• 5.3(2d)
• 5.3(2e)
• 5.3(2f)
• 6.0(1g)
• 6.0(1j)
• 6.0(2h)
• 6.0(2j)
• 6.0(3d)
• 6.0(3e)
• 6.0(3g)
• 6.0(4c)
• 6.0(5h)
• 6.0(5j)
• 6.0(6c)
• 6.0(6g)
• 6.0(6h)
• 6.0(7e)
• 6.0(8d)
• 6.0(8e)
• 6.0(8f)
• 6.0(8h)
• 6.0(9c)
• 6.0(9d)
• 6.0(9e)
• 6.0(9f)
• 6.1(1f)
• 6.1(2f)
• 6.1(2g)
• 6.1(3f)
• 6.1(3g)
• 6.1(4h)
• 6.1(5e)
• 6.2(1f)
• 6.2(1g)
• 6.2(2e)

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion