A flaw in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated, remote attacker to read arbitrary files from the underlying file system. The vulnerability stems from insufficient access control to file system resources, enabling crafted input in UI fields. If successful, the attacker can obtain sensitive files, including key materials that could be used to gain root privileges on the APIC appliance and on connected managed switches, thereby compromising confidentiality and integrity of the entire fabric.

All versions of Cisco Application Policy Infrastructure Controller (APIC) that have not yet been updated to the latest patch are affected. The flaw is tied to the export policies functionality and is limited to devices where administrative credentials are available.

The CVSS score is 6.5, indicating a moderate severity vulnerability. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attack requires an attacker to possess legitimate administrative credentials and to submit crafted input through the APIC user interface. Exploitation enables file disclosure and potentially elevates privileges to root, exposing the entire APIC system and connected network devices. Although no widespread exploitation has been documented, the moderate severity and required access level suggest a focused threat from insiders or attackers who have compromised credentials.