A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote… (CVE-2026-20321)

This vulnerability affects the web-based management API of Cisco APIC. An attacker with valid administrative credentials can exploit insufficient input validation in command arguments to execute arbitrary commands as the root user on the device's underlying operating system. The attack vector requires authentication and crafted input sent via the API. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity but no availability impact.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary commands with root-level access on the affected Cisco APIC device. This can lead to full system compromise, unauthorized data access, and potential disruption of management functions. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative API access to trusted users only and monitor for suspicious activity. No official fix or temporary workaround is provided in the current data.