Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability

published 2026-02-25 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-8672

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits: 0; none known

A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have valid user credentials and any role that includes CLI access.

This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by issuing crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-25)

Exploit prediction

0.10% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Cisco Cisco Application Policy Infrastructure Controller (APIC)

Classification

Weakness

CWE-1220 Insufficient Granularity of Access Control

References

sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-dos-rNus8EFw

Sources

CVE List CVE-2026-20107
NVD CVE-2026-20107

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary