PatchTheCVECVE-2020-3433: Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
CVE-2020-3433 is a high-severity flaw (CVSS 7.8) affecting anyconnect secure mobility client, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vul
Why this priority
- High severity
- EPSS top 4%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Used in ransomware campaigns
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 10.0% (top 4%) |
| CISA exploited list | Yes, fix due 2022-11-14, used in ransomware |
| Weakness | CWE-427 |
| Published | 2020-08-17 |
| Last modified | 2026-08-12 |
Last updated 2026-08-12 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: goichot/CVE-2020-3433 (41 stars)
- Write-up: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26W
- Metasploit: Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-3433?
anyconnect secure mobility client: upgrade to 4.9.00086. Exact commands for each OS are on this page.
Is CVE-2020-3433 being exploited?
Yes. CVE-2020-3433 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2020-3433 affect?
CVE-2020-3433 affects anyconnect secure mobility client. Severity is high (CVSS 7.8). A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attack
How urgent is CVE-2020-3433?
Priority 86/100. High severity; EPSS top 4%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference
Software pages
Windows vulnerabilities · Cisco vulnerabilities
Related CVEs
- CVE-2023-20178 HIGH 7.8 UPGRADE UPGRADE A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows a
- CVE-2020-3153 MEDIUM 6.5 EXPLOITED UPGRADE Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
- CVE-2024-20474 MEDIUM 4.3 DOWNGRADE DOWNGRADE A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could al
- CVE-2023-20241 MEDIUM 5.5 DOWNGRADE DOWNGRADE Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could al
- CVE-2023-20240 MEDIUM 5.5 DOWNGRADE DOWNGRADE Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could al