Yes. CISA added CVE-2020-3433 to its Known Exploited Vulnerabilities catalogue on 24 October 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time.
What “exploited in the wild” means for this CVE
For a CISA KEV-listed flaw, “exploited in the wild” means there is reliable evidence of real-world abuse, not just a proof of concept or theoretical risk. In this case, the practical question is whether the Windows client’s run-time loading weakness can be used before a defender sees it, rather than whether the issue exists on paper.
A useful way to interpret this class of issue is through CISA Known Exploited Vulnerabilities Catalog and the vendor’s own advisory. KEV placement tells you to treat the issue as an active exploitation problem, so exposure review should start from installed client versions and reachable endpoints, not from a generic patch queue.
Because the flaw is a DLL hijacking condition in a Windows application, the security concern is not just code loading, but code execution in the context of a trusted client process. That makes it a reliability and trust-boundary problem as much as a software defect, especially on endpoints that routinely connect to sensitive internal resources.
Why this kind of DLL hijacking matters operationally
DLL hijacking weaknesses become valuable to attackers when an application loads resources in a way that can be influenced by the local environment. If the attacker can place or redirect a malicious library where the application will load it, the program may execute attacker-controlled code under the user’s or system’s trust context.
For defenders, that means the immediate concern is not only the vulnerability itself but the endpoint conditions that make exploitation practical, such as writable directories, weak application control, and delayed patching on remote users’ machines. Cisco AnyConnect is especially relevant because VPN clients often sit at a privileged network chokepoint and are deployed broadly across fleets.
The right mental model is that exploitation can turn a normal connectivity tool into an execution path. Once that happens, the attacker may use the compromised endpoint to steal tokens, pivot into internal systems, or persist on the device long enough to establish follow-on access.
What to do when patching has to wait
First confirm whether the product is present on Windows endpoints and whether any instance is still exposed to the vulnerable behavior described in the vendor guidance. Then prioritize systems that are internet-reachable, frequently remote, or used by privileged staff, because those systems have the highest practical exposure window.
Where patching is delayed, reduce the exploit path by tightening local write permissions, hardening application control, and monitoring for suspicious library loading around the VPN client process. If you have endpoint telemetry, look for unusual DLL loads, child processes, or post-exploitation activity that begins immediately after the client starts.
If there is any sign the weakness may have been abused, treat it as a compromise-assessment issue, not just a patching issue. That means checking the endpoint for persistence, reviewing recent authentication activity, and deciding whether local credentials, active sessions, or nearby administrative access should be reset.
Risk and Threat Considerations
This CVE sits in a class of issues that attackers like because the affected software is widely trusted and commonly present on high-value endpoints. A successful hijack can convert a routine client launch into an execution opportunity, which is why active exploitation claims should be handled as exposure events rather than merely technical defects.
Failure mechanism: The application loads a resource with insufficient validation, allowing a malicious or substituted DLL to be loaded instead of the intended one.
Impact: An attacker can execute code in the context of the user or process, then use that foothold for persistence, credential theft, or lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | DLL hijacking is reduced by hardening endpoint software and load paths. |
| CIS-10 — Malware Defenses | Active exploitation calls for host telemetry and malicious code detection on endpoints. | |
| Recommendation — Harden Windows client configurations to block untrusted library loading paths. Use endpoint detections to spot suspicious DLL loads and post-exploit behavior. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | The flaw can be used to introduce and run malicious code on a trusted endpoint. |
| SI-4 — System Monitoring | Validation of exploitation depends on monitoring process and library-loading behavior. | |
| RA-5 — Vulnerability Monitoring and Scanning | KEV-listed exposure requires confirming where the vulnerable client is deployed. | |
| Recommendation — Apply malicious code protections to detect and block unauthorized code execution. Monitor endpoint process activity for unusual DLL loads and follow-on execution. Continuously identify affected installations and prioritize remediation for exposed hosts. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | The answer depends on finding where the vulnerable client exists in the fleet. |
| DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Exploit detection hinges on endpoint and process monitoring for abnormal behavior. | |
| Recommendation — Identify exposed AnyConnect installations and map them to remediation priority. Monitor endpoints for suspicious library loads and execution anomalies tied to the client. | ||
Practitioner Guidance
What to verify: Confirm whether Windows AnyConnect deployments are still present, whether the affected load path is reachable on those systems, and whether endpoint controls would actually stop an unauthorized DLL from being loaded.
Escalation / exception: If the client is installed on privileged workstations, jump hosts, or remote-access endpoints, treat the issue as a higher-priority exposure even if you have not yet seen signs of abuse. KEV status means the burden is on proving low exposure, not assuming it.
Practitioner takeaway: For KEV-listed client-side flaws, the key decision is whether you can reduce exposure fast enough to stay ahead of real exploitation, or whether you need to assume compromise and validate the endpoint first.
Related resources from NHI Mgmt Group
- Guide: VPN Security Guide
- CVE-2020-3433 (Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking)
- CVE-2020-3153 (Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path)
- Is CVE-2026-20316 (Cisco Secure Firewall Management Center Use of Hard-coded Password) being exploited in the wild?
- Is CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data) being exploited in the wild?