Public mode

No tenant, Graph, or device access. Every item links to its source. What this means

CVE-2020-3153CISA KEV

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

CISA lists this Cisco AnyConnect Secure vulnerability as known exploited. The vendor's advisory has the fixed versions.

CISA catalog record

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.

Product: AnyConnect Secure
Added to KEV: 24 Oct 2022
Federal remediation due: 14 Nov 2022
Known ransomware use: Yes

What changed

First observed 14 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.