Cisco APIC CVE-2026-76488

Exploitation requires valid administrative credentials on the Cisco APIC (PR:H) - this is not a default-configuration remote-unauthenticated bug. The attacker interacts with the export policies functionality and injects crafted values into specific UI fields to abuse insufficient access control to filesystem resources (CWE-264). Key limiting factors: administrative authentication is mandatory, which restricts realistic exploitation to compromised or malicious admin accounts; no user interaction is needed once authenticated (UI:N). The meaningful escalation (to root on APIC and managed switches) depends on sensitive key materials being present and readable on the underlying filesystem.

This is a moderate-risk, high-privilege information-disclosure flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) shows it is network-reachable with low complexity and no user interaction, but the PR:H requirement is the dominant limiting factor: the vendor description explicitly states the attacker must already hold valid administrative credentials on the APIC. That makes this primarily a post-compromise or malicious/compromised-insider escalation path, not a mass-exploitable perimeter bug. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no signal of active or imminent exploitation - no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-vs-description conflict), though note that the real impact is amplified beyond simple file read: the description says the exposed key materials can be used to elevate to root on the APIC and on managed switches, which justifies the C:H/I:H rating despite the mechanism being file access. Priority should be treated as moderate: significant blast radius if an admin account is compromised, but gated behind administrative authentication.

An attacker who has obtained valid APIC administrative credentials (e.g., via phishing, credential reuse, or a rogue insider) logs into the controller and, within the export policies functionality, submits crafted values in specific UI fields to read sensitive files from the underlying filesystem. Among the exposed files are key materials that the attacker then uses to escalate to root on the APIC and pivot to managed switches across the ACI fabric. No public exploit code was identified in the provided data.