Detections
Analytics

Cisco Application Policy Infrastructure Controller Unauthorized File Access (cisco-sa-apic-info-priv-enAdB5vD)

medium Nessus Plugin ID 364470

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco Application Policy Infrastructure Controller (APIC) is affected by a vulnerability.

 - A privilege escalation vulnerability exists in the export policies functionality due to insufficient access control to file system resources. An authenticated, remote attacker can exploit this, by submitting specially crafted values in specific UI fields, to gain root access to the affected device and managed switches.
 (CVE-2026-76488)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu02922

See Also

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu02922

http://www.nessus.org/u?61a0f190

Plugin Details

Severity: Medium

ID: 364470

File Name: cisco-sa-apic-info-priv-enAdB5vD.nasl

Version: 1.1

Type: Remote

Family: CISCO

Published: 10/9/2026

Updated: 10/9/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.44

CVSS v2

Risk Factor: High

Base Score: 7.7

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:N

CVSS Score Source: CVE-2026-76488

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Vulnerability Information

CPE: cpe:/a:cisco:application_policy_infrastructure_controller

Required KB Items: installed_sw/Cisco APIC Software

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/7/2026

Reference Information

CVE: CVE-2026-76488

CWE: 264

CISCO-SA: cisco-sa-apic-info-priv-enAdB5vD

IAVA: 2026-A-1089

CISCO-BUG-ID: CSCwu02922