Is CVE-2020-3153 (Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2020-3153 to its Known Exploited Vulnerabilities catalogue on 24 October 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. Any organisation running the affected product should treat remediation as urgent.

What the Cisco AnyConnect CVE means operationally

CVE-2020-3153 is not just a historical bug for patch notes, because CISA’s KEV listing is a strong signal that it has been used against real environments and should be treated as an active exposure. The practical question is whether any Windows endpoint still runs the affected client and whether that software can be reached by an attacker or abused locally after another foothold.

The vulnerability sits in the client’s handling of directory paths, which makes endpoint hygiene and software inventory the first line of defence. A vulnerability that is already in the KEV catalogue should be handled as an urgent remediation item, not as a routine deferred update. For broader prioritisation, teams should use the same triage discipline they apply to other vulnerability management decisions, with exposure and exploitability outweighing abstract severity discussions.

Because the issue affects a remote-access client, the business impact is often larger than the software name suggests. Remote connectivity tools usually sit on high-value endpoints, interact with enterprise credentials, and can become a stepping stone to internal resources if they are compromised or misused.

Why in-the-wild exploitation changes the response

“Exploited in the wild” changes the response from routine patch scheduling to evidence-driven urgency. When a vulnerability is confirmed in active exploitation, the question is no longer whether exploitation is plausible, but whether your estate is still exposed and whether adversaries may already have used it as an entry point or persistence mechanism. That is why CISA’s Known Exploited Vulnerabilities Catalog is more operationally useful than a generic advisory list.

For defenders, the important distinction is between a vulnerable installation and a vulnerable installation that has already been targeted. The second case justifies faster isolation, tighter monitoring, and a lower threshold for hunting signs of compromise, especially on machines that hold privileged sessions or can reach sensitive internal services.

Active exploitation also means that exploit availability, not just flaw existence, is part of the risk picture. Public knowledge of abuse patterns shortens the time between disclosure and real-world abuse, which is why teams should treat KEV entries as inputs to emergency patching queues rather than backlog items.

What to check before you call it remediated

Start by confirming whether Windows systems still have Cisco AnyConnect Secure Mobility Client installed, where it is deployed, and which business units depend on it. Inventory accuracy matters here because endpoint VPN software is often installed outside the normal application management path, especially on roaming laptops and contractor devices.

If you cannot patch immediately, reduce exposure by limiting who can use the client, restricting where it can be launched from, and watching for unusual process behaviour on endpoints that host it. When a vulnerability is already associated with real-world exploitation, compensating controls should focus on blast-radius reduction and detection, not on assuming that absence of obvious alerts means safety.

After remediation, validate more than version status. Check for signs of abnormal logons, unexpected persistence, unusual child processes, and any new credential use from devices that had the vulnerable software installed. If the endpoint also stored high-value sessions, treat those sessions as suspect until you have a reason to trust them again.

Risk and Threat Considerations

The main risk is that a vulnerable remote-access client can give an attacker an easier path into a trusted endpoint, especially where the endpoint has broad network reach or privileged access. In a KEV-listed case, that exposure is no longer theoretical, and delayed action increases the chance that the flaw is already part of an intrusion path.

Failure mechanism: Incorrect directory-path handling can be abused to interfere with how the client resolves or loads files, which may let an attacker execute code or otherwise leverage the weakness on a Windows system that still trusts the vulnerable software.

Impact: Successful exploitation can lead to endpoint compromise, credential exposure, internal pivoting, and faster follow-on abuse of remote-access trust relationships, especially if the affected host is already a gateway to other assets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes prioritised vulnerability remediation central to the question.
Recommendation — Prioritise and remediate KEV-listed software exposures immediately.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	The answer depends on finding where the vulnerable client is installed and exposed.
	PR.PS-02 — Software, firmware, and information are maintained to meet security requirements	The flaw requires urgent maintenance of the affected client software.
	DE.CM-08 — Vulnerabilities are monitored and acted upon	KEV status requires monitoring for exploitation and response to known vulnerable software.
Recommendation — Maintain current asset and vulnerability inventory for exposed endpoints. Apply security updates or mitigations to affected software without delay. Track KEV-listed vulnerabilities and escalate response when exploitation is confirmed.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The question is about active exploitation of a software weakness as an attack path.
Recommendation — Map exploit indicators to the intrusion path and hunt for related activity.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The subject is a vulnerable product requiring exposure confirmation and ongoing scan coverage.
	SI-2 — Flaw Remediation	The answer centers on urgent remediation of a known exploited flaw.
	IR-4 — Incident Handling	In-the-wild exploitation requires investigation for possible compromise, not just patching.
Recommendation — Scan for the affected client and validate remediation status continuously. Remediate the flaw promptly and verify the fix across all affected systems. Investigate affected systems for compromise before returning them to trust.

Practitioner Guidance

What to prioritise: Treat any internet-reachable or privileged endpoint running the client as the highest-priority remediation target, then move down to standard user laptops. If you have limited maintenance windows, patch the systems that can touch production resources first.

What to verify: Confirm installed version, active usage, and whether the endpoint has recent anomalous authentication, new local accounts, suspicious scheduled tasks, or odd child processes associated with the client. For a KEV-listed item, remediation is not complete until you have checked for earlier compromise as well as installed the fix.

Practitioner takeaway: Once CISA puts a flaw in KEV and associates it with ransomware use, the right response is urgent exposure reduction plus compromise hunting, not a patch-only mindset.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org