【Vulnerability Alert】Cisco Application Policy Infrastructure Controller has 3 critical security vulnerabilities

• Subject:Cisco Application Policy Infrastructure Controller has 3 critical security vulnerabilities

• Description:
  • Forwarded from the TWCERT/CC Security Alert TWCERTCC-200-202610-00000027
  • The Cisco Application Policy Infrastructure Controller development team discovered multiple security vulnerabilities during an internal security review, which have now been fixed. There is currently no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and streamline the vulnerability disclosure process, Cisco has published the related vulnerability information and remediation recommendations.
  • CVE-2026-76498, CVSS: 9.8, improper access control vulnerability.
  • CVE-2026-76499, CVSS: 9.8, improper handling vulnerability.
  • CVE-2026-76500, CVSS: 9.8, improper controls present throughout the product's lifecycle.
• Affected Platforms:
  • Versions prior to and including Cisco APIC 5.3, Cisco APIC version 6.0, Cisco APIC version 6.1, Cisco APIC version 6.2
• Recommended Actions:
  • Please update to the following versions: Cisco APIC 6.0 (9h) and later, Cisco APIC 6.1 (6g) and later, Cisco APIC 6.2 (3g) and later
• References:
  1. https://www.twcert.org.tw/tw/cp-169-11291-c25ec-1.html

Computer and Communication Center
Network System Division