Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.
CVE-2026-20321
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-20321
Cisco Application Policy Infrastructure Controller (APIC)
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Cisco",
"product": "Cisco Application Policy Infrastructure Controller (APIC)",
"versions": [
{
"status": "affected",
"version": "5.3(1d)"
},
{
"status": "affected",
"version": "5.3(2a)"
},
{
"status": "affected",
"version": "5.3(2b)"
},
{
"status": "affected",
"version": "5.3(2c)"
},
{
"status": "affected",
"version": "5.3(2d)"
},
{
"status": "affected",
"version": "5.3(2e)"
},
{
"status": "affected",
"version": "5.3(2f)"
},
{
"status": "affected",
"version": "6.1(5e)"
},
{
"status": "affected",
"version": "6.2(1f)"
},
{
"status": "affected",
"version": "6.2(1g)"
},
{
"status": "affected",
"version": "6.2(2e)"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-20321
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12970 · Revision 1
- Added to Heist Feed
- Publisher date