CVE-2021-1581: Cisco Application Policy Infrastructure Controller

Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco Application Policy Infrastructure Controller: before 3.2\(10f\) (fixed in 3.2\(10f\)); from 4.0, before 4.2\(7l\) (fixed in 4.2\(7l\)); from 5.0, before 5.2\(1g\) (fixed in 5.2\(1g\))
• Cisco Cloud Application Policy Infrastructure Controller: before 3.2\(10f\) (fixed in 3.2\(10f\)); from 4.0, before 4.2\(7l\) (fixed in 4.2\(7l\)); from 5.0, before 5.2\(1g\) (fixed in 5.2\(1g\))

Published 2021-08-25. Last modified 2026-06-17.