CVE-2026-76499
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-76499 is a critical-severity Improper Neutralization (CWE-707) vulnerability in Cisco Application Policy (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-94471
Vulnerability Data
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…
more
vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach improper neutralization in the design/coding/testing phases, but leaves a bounded remainder (e.g. incomplete enforcement of guidelines, outsourced development without full assurance, or post-release changes) where the weakness can still be introduced and exploited.
Application security requirements explicitly call for data validation and sanitization controls addressing neutralization weaknesses.
A.8.27 mandates security-by-design principles (e.g. distrust external input, data validation/sanitization, defense-in-depth, secure architecture reviews) that reach a minority slice of improper neutralization cases but leave most instances (implementation bugs, incomplete coverage of parsers/protocols, post-design defects) unaddressed.
Secure coding standards directly require proper neutralization of inputs and outputs, eliminating CWE-707.
Security testing can detect neutralization flaws but does not itself implement the required controls.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-707, a pillar-level weakness, and none of its children carries one either.