CVE-2021-1580: Cisco Application Policy Infrastructure Controller

High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days.

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco Application Policy Infrastructure Controller: before 3.2\(10e\) (fixed in 3.2\(10e\)); from 4.0, before 4.2\(6h\) (fixed in 4.2\(6h\)); from 5.0, before 5.1\(3e\) (fixed in 5.1\(3e\))
• Cisco Cloud Application Policy Infrastructure Controller: before 3.2\(10e\) (fixed in 3.2\(10e\)); from 4.0, before 4.2\(6h\) (fixed in 4.2\(6h\)); from 5.0, before 5.1\(3e\) (fixed in 5.1\(3e\))

Published 2021-08-25. Last modified 2026-06-17.