CVE-2026-76498

🎯 CVE-2026-76498 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-76498 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakn

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

Klassifikation & Betroffenheit:

CWE-284 Cisco Cisco Application Policy Infrastructure Controller (APIC) 5.2(8i)Cisco Application Policy Infrastructure Controller (APIC) 5.2(2f)Cisco Application Policy Infrastructure Controller (APIC) 5.2(2g)Cisco Application Policy Infrastructure Controller (APIC) 5.3(2c)Cisco Application Policy Infrastructure Controller (APIC) 6.0(5j)Cisco Application Policy Infrastructure Controller (APIC) 5.3(1d)Cisco Application Policy Infrastructure Controller (APIC) 6.0(8e)Cisco Application Policy Infrastructure Controller (APIC) 6.0(6c)

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

🛡️ Empfohlene Mitigation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-19 · Embedding Scripts within Scripts (High) CAPEC-441 · Malicious Logic Insertion (High) CAPEC-478 · Modification of Windows Service Configur… (High) CAPEC-479 · Malicious Root Certificate (Low) CAPEC-502 · Intent Spoof CAPEC-503 · WebView Exposure CAPEC-536 · Data Injected During Configuration (High) CAPEC-546 · Incomplete Data Deletion in a Multi-Tena… (Medium)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.009 · Obfuscated Files or Information: E… T1546.004 · Event Triggered Execution:.bash_pr… T1546.016 · Event Triggered Execution: Install… T1574.011 · Hijack Execution Flow:Service Regi… T1543.003 · Create or Modify System Process:Wi… T1553.004 · Subvert Trust Controls:Install Roo…

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-76482 10.0 CVE-2026-97163 10.0 CVE-2026-83944 10.0 CVE-2026-76460 10.0 CVE-2026-76423 10.0

🇩🇪 BSI-Sicherheitshinweise: BSI · hoch · Cisco Application Policy Infrastructure Controller: Mehrere Schwachste ↗

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvi…

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 21.10.

CVSS-Vektor-Analyse: 9.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA-Bewertung (cisco): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:07.10.2026

Aktualisiert:07.10.2026 18:05

Assigner (CNA):cisco

EUVD-ID:EUVD-2026-94472

CWE-284 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Management-Interface vom Internet trennen und ACLs auf vertrauenswürdige IPs beschränken.

Tier	CVEs	Anteil
≥90 %	726	0,2 %
≥50 %	3.223	0,9 %
≥10 %	22.086	5,9 %
<10 %	346.410	93,0 %

Noch keine Analyse zu CVE-2026-76498

Beitrag zu CVE-2026-76498 verfassen

Zero-Day & Vulnerability Intelligence Hub