Cisco APIC EUVD-2026-94473

The attacker requires network reachability to the Cisco APIC controller (its management/API plane); per AV:N/PR:N/UI:N the vendor indicates no authentication and no user interaction are needed against the affected software versions. A key limiting factor is that APIC is a data-center SDN controller typically deployed on isolated or restricted management networks, so exploitation depends on the attacker first reaching that management segment. The description does not name any specific feature, protocol, or non-default configuration as a prerequisite - it only states the issue falls under improper resource-lifecycle control (CWE-664) - so the precise triggering condition cannot be extracted and should be confirmed against Cisco advisory cisco-sa-hardening-apic-UOXWtfh.

This is a Cisco-reported, internally discovered vulnerability in the Cisco Application Policy Infrastructure Controller (APIC) carrying a vendor CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on paper implies remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact. However, the severity signals and the real-world signals diverge sharply: there is no EPSS score provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - the status is 'no public exploit identified at time of analysis.' The advisory language ('proactive security and product quality,' 'comprehensive internal security review,' 'software hardening releases') indicates this was found internally by Cisco rather than through observed attacks, strongly suggesting no active exploitation. A major data-quality caveat: the CWE is CWE-664, a broad Pillar-level weakness ('Improper Control of a Resource Through its Lifetime') that conveys no concrete technical detail, and the description explicitly bundles 'multiple internally discovered vulnerabilities' under one identifier, so the 9.8 vector cannot be mapped to a specific exploitable flaw from the data given. The 'Information Disclosure' tag also conflicts with the C:H/I:H/A:H vector, which claims full-triad impact rather than disclosure alone - verify with the Cisco advisory. Net assessment: treat as a high-priority patch for organizations running APIC because of the critical vendor score and the sensitive, high-value nature of the SDN controller, but recognize the real-world exploitation likelihood is presently unquantified and there is no evidence of in-the-wild activity.

Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), a remote attacker with network reachability to the APIC management plane sends crafted traffic to the controller to trigger the resource-lifecycle flaw, gaining the ability to compromise confidentiality, integrity, and availability of the data-center fabric controller. No proof-of-concept is publicly available, and the single generic 'hardening' advisory provides no exploitation specifics, so the exact attack primitive cannot be reconstructed from available data.