Cisco Application Policy Infrastructure Controller vulnerabilities

34 CVEs affecting Cisco Application Policy Infrastructure Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-20119, published 2025-02-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-1388, published 2021-02-24. Critical severity, CVSS 10.0. EPSS: 14.8% chance of exploitation in the next 30 days. A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on…
CVE-2019-1889, published 2019-07-04. High severity, CVSS 7.2. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticated, remote attacker to escalate…
CVE-2021-1393, published 2021-02-24. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific…
CVE-2021-1579, published 2021-08-25. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated,…
CVE-2021-1578, published 2021-08-25. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated,…
CVE-2021-1580, published 2021-08-25. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection…
CVE-2021-1577, published 2021-08-25. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an…
CVE-2019-1692, published 2019-05-03. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, remote attacker to access sensitive system…
CVE-2017-6767, published 2017-08-17. High severity, CVSS 7.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the account is assigned. The attacker will be…
CVE-2021-1581, published 2021-08-25. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection…

Latest

CVE-2025-20119, published 2025-02-26. Medium severity, CVSS 5.7. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit…
CVE-2025-20118, published 2025-02-26. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit…
CVE-2025-20117, published 2025-02-26. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit…
CVE-2025-20116, published 2025-02-26. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have…
CVE-2024-20478, published 2024-08-28. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an…
CVE-2024-20279, published 2024-08-28. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of…
CVE-2023-20230, published 2023-08-23. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to read, modify, or delete…
CVE-2023-20011, published 2023-02-23. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an…
CVE-2021-1582, published 2021-08-25. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting…