Cisco October 2026 APIC Release Fixes Admin-Authenticated Flaws

Cisco’s October 2026 APIC hardening release fixes admin-only command injection and file-access flaws that can yield root and are not known exploited.

Cisco published October 2026 advisories for Application Policy Infrastructure Controller and a security hardening release following an internal engineering review. An authenticated remote attacker with administrative credentials can send crafted API input and execute arbitrary commands as root because command arguments are insufficiently validated. A related advisory says an authenticated administrator can submit crafted export-policy UI values and read sensitive filesystem files, including key material that could enable root privilege escalation, because of insufficient access control. Cisco has released software updates, and none of the reports describe observed or in-the-wild exploitation. The hardening notice says the issues were found in internal testing, grouped by Common Weakness Enumeration class, and assigned a single CVE, while the other two advisories describe distinct command-injection and unauthorized file-access flaws and do not name a CVE identifier.

• On 2026-10-07 Cisco disclosed APIC flaws and an October 2026 security hardening release after an internal engineering review.
• An authenticated remote attacker with administrative credentials can inject web-management API commands that execute as root because command arguments are insufficiently validated.
• An authenticated administrator can submit crafted export-policy UI values and read sensitive filesystem files, including key material that could enable root privilege escalation, due to insufficient access control.
• Cisco has released software updates; none of the reports state observed or in-the-wild exploitation.
• The hardening notice says multiple internally found issues were grouped by CWE under a single CVE; the two vulnerability advisories describe separate flaws and do not name a CVE identifier.