CVE-2021-1396: Cisco Application Policy Infrastructure Controller

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco Application Policy Infrastructure Controller: version 1.1.3 only
• Cisco Application Services Engine: from 1.1, before 1.1\(3e\) (fixed in 1.1\(3e\))

Published 2021-02-24. Last modified 2026-06-17.