Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Advisory TWCERTCC-200-202610-00000027

[Description]
The Cisco Application Policy Infrastructure Controller development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, no evidence has been found indicating that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations.
CVE-2026-76498, CVSS: 9.8, is an improper access control vulnerability.
CVE-2026-76499, CVSS: 9.8, is an improper handling vulnerability.
CVE-2026-76500, CVSS: 9.8, involves improper control within the product's lifecycle.

[Affected Platforms]
Cisco APIC versions 5.3 and earlier, Cisco APIC version 6.0, Cisco APIC version 6.1, Cisco APIC version 6.2

[Recommendations]
Please update to the following versions: Cisco APIC 6.0 (9h) and later versions, Cisco APIC 6.1 (6g) and later versions, Cisco APIC 6.2 (3g) and later versions

[References]
1. https://www.twcert.org.tw/tw/cp-169-11291-c25ec-1.html