Cisco Application Policy Infrastructure Controller Apic
Monthly
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.