What’s Vulnerable › Vulnerabilities

CVE-2021-1396: Cisco Application Services Engine Unauthorized Access Vulnerabilities

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-24 · updated 2026-06-17
• Weakness: CWE-306

Description

Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

• Cisco Application Policy Infrastructure Controller (APIC): 1.1.3-c, 1.1.3-d
• Cisco Application Services Engine: from 1.1 before 1.1\(3e\) — fixed in 1.1\(3e\)

How to fix

Upgrade to a fixed version: Cisco Application Services Engine 1.1\(3e\). Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-case-mvuln-dYrDPC6w

Get alerted when CVE-2021-1396 or the next vulnerability affects your stack