FAIL › dossier
AnyConnect Secure
PRODUCT· dossier confidence 40%
Cisco AnyConnect Secure Client faces significant security risks due to critical vulnerabilities, including remote code execution flaws.
PROFILE
CategorySecurity SoftwareWhat they doCisco AnyConnect Secure Client is a remote access solution for secure network connectivity.Ownershippublic
Websitehttps://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/release/notes/release-notes-cisco-secure-client-5-1.html ↗
SECURITY POSTURE
High risk due to critical vulnerabilities in remote code execution (RCE) and directory path handling.
Notable failures
- CVE-2020-3433 (RCE)
- CVE-2020-3153 (RCE)
- CVE-2026-20133 (RCE)
Patterns: repeated critical RCE vulnerabilities; insufficient file system restrictions
FAILURE HISTORY · 2
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-10-24 | CVE-2020-3433 | critical | Cisco AnyConnect's IPC channel allowed attackers with valid Windows credentials to execute SYSTEM-level code via DLL hijacking. |
| 2022-10-24 | CVE-2020-3153 | critical | Cisco AnyConnect for Windows mishandles directory paths, allowing attackers with valid credentials to copy malicious files to arbitrary locations with system-level privileges. |
DOSSIER SOURCES
- Release Notes for Cisco Secure Client (including AnyConnect), Release 5 ... · www.cisco.com
- Cisco CVEs and Security Vulnerabilities - OpenCVE · app.opencve.io
- CVEs and Security Vulnerabilities - OpenCVE · app.opencve.io
Open questions: What steps has Cisco taken to address these vulnerabilities? · Is there a timeline for patching these vulnerabilities?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-05 03:45:22.682880+00:00