Medium severity · published Feb 25, 2026
CVE-2026-20107
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have valid user credentials and any role that includes CLI access.
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by issuing crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cisco Application Policy Infrastructure Controller (APIC) · Cisco
6.1(1f); 6.1(2f); 6.1(2g); 6.1(3f); 6.1(3g) · source: vendor
Affected product
CA
Cisco Application Policy Infrastructure Controller (APIC)
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20107
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20107
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-dos-rNus8EFw
More from Cisco Application Policy Infrastructure Controller (APIC)
9.8
CVE-2026-76500
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities
9.8
CVE-2026-76498
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities
9.8
CVE-2026-76499
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
7.2
CVE-2024-20478
Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
6.7
CVE-2025-20117
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability
