Cisco APIC: Improper control of a resource through its lifetime
Summary
Cisco's October 2026 hardening release for APIC fixes several internally discovered vulnerabilities grouped under CWE-664 (improper control of a resource through its lifetime). According to the CVSS vector, an unauthenticated attacker with network access to APIC could fully compromise confidentiality, integrity and availability, regardless of device configuration. Cisco does not publish the individual issues, so the exact code paths and prerequisites are unknown. Cisco is not aware of any public exploit or malicious use.
Affected
- Cisco APIC 5.3 and earlier (including 5.2(1g) to 5.2(5d) as listed in the CVE record); migrate to a fixed release
- Affected regardless of device configuration
- Default configuration: unknown
Fixed in
- APIC 6.0: 6.0(9h)
- APIC 6.1: 6.1(6g)
- APIC 6.2: 6.2(3g)
Workaround
No workarounds available according to Cisco.
Interim measure (third-party recommendation): restrict access to the APIC management interface to trusted networks until the upgrade is complete.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- Not listed as known exploited in CISA KEV as far as known.
Our recommendation
- Inventory all APIC instances and their versions.
- Upgrade to the fixed release for your branch, or migrate from 5.3 and earlier.
- Until patched, limit management access to APIC to trusted administrative networks.
- Keep configuration backups and verify high availability before upgrading.
- Monitor APIC access logs for unusual management activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-hardening-apic-UOXWtfh sec.cloudapps.cisco.com
- Secure-ISS: Cisco NX-OS, APIC and Meraki critical vulnerabilities www.secure-iss.com
- Vuln.management advisory CVE-2026-76500 vuln.management
- Strix CVE entry CVE-2026-76500 www.strix.ai
- Rapid7 via Vulners: CISCO-APIC-CVE-2026-76500 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:43.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.