CVE-2026-76500

CriticalCVSS 9.8/10Last modified Nov 7, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76500 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco Application Policy Infrastructure Controller (APIC)5.2(1g); 5.2(2e); 5.2(2f); 5.2(2g); 5.2(2h); 5.2(3f); 5.2(3e); 5.2(3g); 5.2(4d); 5.2(4e); 5.2(5d); 5.2(5c); 6.0(1g); 5.2(5e); 5.2(4f); 5.2(6e); 6.0(1j); 5.2(6g); 5.2(7f); 5.2(7g)

References

Timeline

Published
Oct 7, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-765019.8A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, knCVE-2026-765049.8A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote aCVE-2026-765057.5A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series AggregationCVE-2026-765067.6A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieveCVE-2026-76515.3The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & LCVE-2026-765199.8A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attackCVE-2026-76525.3The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest bookiCVE-2026-765247.8A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with lCVE-2026-765268.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revieCVE-2026-765279.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revieCVE-2026-765289.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revieCVE-2026-765299.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie
CVE-2026-76500: Critical severity, CVSS 9.8 | Vulnix