{"id":"CVE-2026-76488","revision":"ea79c2432643473fb553ff8335a6ef8a","records":[{"revision":"ea79c2432643473fb553ff8335a6ef8a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-76488","aliases":[],"title":"Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerability","description":"A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.\r\n\r\nThis vulnerability is due to insufficient access control to file system resources. An attacker could exploit this vulnerability by submitting crafted values in specific UI fields. A successful exploit could allow the attacker to access sensitive files from the underlying file system of an affected device, including key materials that could be used to elevate privileges to root on the affected APIC and on managed switches.","state":0,"publishedAt":"2026-10-07T16:17:16.951+00:00","modifiedAt":"2026-10-08T03:56:07.278+00:00","affected":[{"ecosystem":"Vendor product","name":"Cisco Application Policy Infrastructure Controller (APIC)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Cisco\",\n                    \"product\": \"Cisco Application Policy Infrastructure Controller (APIC)\",\n                    \"versions\": [\n                        {\n                            \"version\": \"5.2(1g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(2e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(2g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(2h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(3f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(3e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(3g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(4d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(4e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(5d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(5c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(1g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(5e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(4f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(6e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(1j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(6g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(7f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(7g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(2h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(6h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(4h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(2j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(3d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(3e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(1d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(4c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.2(8i)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(5h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2b)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(3g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(5j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(6c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.1(1f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(7e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(8d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(8e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.1(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(8f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.1(2g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"5.3(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(9c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(9d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(6g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(6h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(8h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(9e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"6.0(9f)\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76488","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-76488","identifiers":["CVE-2026-76488"]},"retained":false,"historicalAffected":[]}],"coverage":[]}