CVE-2026-76498
Received Received - Intake

Improper Access Control in Cisco APIC

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-76498
EUVD
EUVD-2026-94472

Affected Vendors & Products

Showing 65 associated CPEs
Vendor Product Version / Range
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(1g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(2e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(2f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(2g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(2h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(3f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(3e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(3g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(4d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(4e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(5d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(5c)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(1g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(5e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(4f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(6e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(1j)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(6g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(7f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(7g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(2h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(6h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(4h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(2j)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(3d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(3e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(1d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(4c)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2a)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8i)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(5h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2b)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(3g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(5j)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2c)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(6c)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(1f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(7e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(8d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(8e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(2f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(8f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(2g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.3(2f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(9c)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(3f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(9d)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(6g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(6h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(8h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(3g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(4h)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(9e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.1(5e)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.2(1f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.2(1g)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.0(9f)
Cisco Cisco Application Policy Infrastructure Controller (APIC) 6.2(2e)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76498 is a critical improper access control vulnerability in Cisco's Application Policy Infrastructure Controller (APIC). It falls under CWE-284, which includes issues with authorization, authentication, privileges, and bypasses. Discovered during Cisco's internal security review, it has a CVSS score of 9.8, indicating high severity.

Detection Guidance

Detection requires checking the Cisco APIC software version against fixed releases. Use the APIC CLI command 'show version' to verify the current version. Compare it with the fixed versions 6.0(9h), 6.1(6g), or 6.2(3g) or later. If running an older version, the system is vulnerable.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive system functions or data due to improper access controls. Attackers might exploit it to gain elevated privileges, bypass authentication, or perform unauthorized actions on affected Cisco APIC systems.

Compliance Impact

The vulnerability's improper access control (CWE-284) could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's access control mandates. Unauthorized access risks exposing personal or health data, which may result in non-compliance with these regulations.

Mitigation Strategies
  • Upgrade Cisco APIC to fixed software versions 6.0(9h), 6.1(6g), 6.2(3g) or later as specified in Cisco's advisory.
  • Apply software updates immediately since no workarounds are available and the vulnerability has a CVSS score of 9.8.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart