Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-20321: Cisco APIC API lets admin attacker run commands as root
CVE-2026-20321 · published 28 days ago
Summary
The web‑based management interface of Cisco’s Application Policy Infrastructure Controller can be tricked into running any command on the device if the attacker already has a valid administrator login. This would give the attacker full control over the system, potentially compromising all data and services it supports. Apply any available software updates, enforce strong administrator passwords, and limit API access to trusted networks or users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | cisco application policy infrastructure controller (apic) | 5.3(1d) |
Original advisory text
Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.
This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-544Missing Standardized Error Handling Mechanism
Timeline
Published7 Oct 2026
Updated4 Nov 2026
First seen7 Oct 2026
Track software like this
Free during beta