CVE-2026-76500
Estado: RecibidaCrítica (9.8)—
The vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
Detalles técnicos trazas, registros y código del informe original
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1059Command and Scripting Interpreterexecution75 % - Impacto secundario
T1078.001Default Accountsstealth · persistence · privilege escalation · initial access60 % - Impacto secundario
T1565.001Stored Data Manipulationimpact65 %
Vector CVSS:3.1 AV:N/AC:L/PR:N/UI:N indica acceso remoto sin autenticación ni interacción de usuario, aplicable a APIC expuesto en red. CWE-664 (improper control of resource lifetime) típicamente causa ejecución de código no autorizada, manipulación de datos y acceso a credenciales en aplicaciones d
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-664
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-76500",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Application Policy Infrastructure Controller (APIC)",
"versions": [
{
"status": "affected",
"version": "5.2(1g)"
},
{
"status": "affected",
"version": "5.2(2e)"
},
{
"status": "affected",
"version": "5.2(2f)"
},
{
"status": "affected",
"version": "5.2(2g)"
},
{
"status": "affected",
"version": "5.2(2h)"
},
{
"status": "affected",
"version": "5.2(3f)"
},
{
"status": "affected",
"version": "5.2(3e)"
},
{
"status": "affected",
"version": "5.2(3g)"
},
{
"status": "affected",
"version": "5.2(4d)"
},
{
"status": "affected",
"version": "5.2(4e)"
},
{
"status": "affected",
"version": "5.2(5d)"
},
{
"status": "affected",
"version": "5.2(5c)"
},
{
"status": "affected",
"version": "6.0(1g)"
},
{
"status": "affected",
"version": "5.2(5e)"
},
{
"status": "affected",
"version": "5.2(4f)"
},
{
"status": "affected",
"version": "5.2(6e)"
},
{
"status": "affected",
"version": "6.0(1j)"
},
{
"status": "affected",
"version": "5.2(6g)"
},
{
"status": "affected",
"version": "5.2(7f)"
},
{
"status": "affected",
"version": "5.2(7g)"
},
{
"status": "affected",
"version": "6.0(2h)"
},
{
"status": "affected",
"version": "5.2(6h)"
},
{
"status": "affected",
"version": "5.2(4h)"
},
{
"status": "affected",
"version": "5.2(8d)"
},
{
"status": "affected",
"version": "6.0(2j)"
},
{
"status": "affected",
"version": "5.2(8e)"
},
{
"status": "affected",
"version": "6.0(3d)"
},
{
"status": "affected",
"version": "6.0(3e)"
},
{
"status": "affected",
"version": "5.2(8f)"
},
{
"status": "affected",
"version": "5.2(8g)"
},
{
"status": "affected",
"version": "5.3(1d)"
},
{
"status": "affected",
"version": "5.2(8h)"
},
{
"status": "affected",
"version": "6.0(4c)"
},
{
"status": "affected",
"version": "5.3(2a)"
},
{
"status": "affected",
"version": "5.2(8i)"
},
{
"status": "affected",
"version": "6.0(5h)"
},
{
"status": "affected",
"version": "5.3(2b)"
},
{
"status": "affected",
"version": "6.0(3g)"
},
{
"status": "affected",
"version": "6.0(5j)"
},
{
"status": "affected",
"version": "5.3(2c)"
},
{
"status": "affected",
"version": "6.0(6c)"
},
{
"status": "affected",
"version": "6.1(1f)"
},
{
"status": "affected",
"version": "6.0(7e)"
},
{
"status": "affected",
"version": "5.3(2d)"
},
{
"status": "affected",
"version": "6.0(8d)"
},
{
"status": "affected",
"version": "6.0(8e)"
},
{
"status": "affected",
"version": "6.1(2f)"
},
{
"status": "affected",
"version": "6.0(8f)"
},
{
"status": "affected",
"version": "5.3(2e)"
},
{
"status": "affected",
"version": "6.1(2g)"
},
{
"status": "affected",
"version": "5.3(2f)"
},
{
"status": "affected",
"version": "6.0(9c)"
},
{
"status": "affected",
"version": "6.1(3f)"
},
{
"status": "affected",
"version": "6.0(9d)"
},
{
"status": "affected",
"version": "6.0(6g)"
},
{
"status": "affected",
"version": "6.0(6h)"
},
{
"status": "affected",
"version": "6.0(8h)"
},
{
"status": "affected",
"version": "6.1(3g)"
},
{
"status": "affected",
"version": "6.1(4h)"
},
{
"status": "affected",
"version": "6.0(9e)"
},
{
"status": "affected",
"version": "6.1(5e)"
},
{
"status": "affected",
"version": "6.2(1f)"
},
{
"status": "affected",
"version": "6.2(1g)"
},
{
"status": "affected",
"version": "6.0(9f)"
},
{
"status": "affected",
"version": "6.2(2e)"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2026-10-07T17:17:01.963",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh",
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Received",
"weaknesses": [
{
"type": "Primary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-664"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \r\n\r\nThe vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664."
}
],
"lastModified": "2026-10-07T17:17:01.963",
"sourceIdentifier": "psirt@cisco.com"
}