Cisco APIC CVE-2026-20321

Exploitation requires valid administrative credentials for the Cisco APIC web-based management API - the attacker must already be an authenticated admin (PR:H), which is the primary limiting factor and confines realistic risk to insider threats, compromised admin accounts, or environments exposing the APIC management API to untrusted networks. The specific trigger is sending crafted values in a user-controlled command argument to the API, where insufficient input validation allows the input to reach OS command execution. No user interaction and no non-default feature toggle is described; the management/API interface being reachable by the attacker is the deployment prerequisite. Mitigation centers on restricting management-plane network exposure and tightly controlling APIC admin credentials.

This is a genuine but access-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5 MEDIUM) describes network-reachable, low-complexity exploitation with no user interaction, but gated behind PR:H - the description explicitly requires valid administrative credentials. The real-world severity therefore hinges entirely on how exposed and well-protected APIC admin credentials are: an attacker who already holds admin access on an ACI fabric controller gains full root command execution on the underlying OS, a meaningful privilege-and-scope escalation from managed-plane admin to unrestricted OS root. No EPSS score, KEV listing, or public POC is provided in the input, so there is no signal of active or imminent mass exploitation - this reads as a high-value-but-high-barrier issue rather than a drop-everything internet-wide emergency. Signals are internally consistent (network vector, authenticated, no availability impact claimed by vendor), with one caveat: the vendor sets A:N, yet root-level arbitrary command execution would realistically permit service disruption, so A:N likely understates impact. The CWE-544 ('Missing Standardized Error Handling Mechanism') and the 'Information Disclosure' tag both conflict with the description, which plainly describes command injection leading to RCE - treat those two labels as unreliable.

An attacker who has obtained valid APIC administrative credentials (via phishing, credential reuse, or a malicious/compromised insider) authenticates to the web-based management API and submits a request containing crafted values in a user-controlled command argument. Because input validation is insufficient, the injected input is passed to the underlying OS and executed, giving the attacker arbitrary command execution as root on the APIC appliance. No public exploit code is identified at time of analysis, and the low attack complexity means a single crafted API call suffices once authenticated.