Is CVE-2023-20269 (Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-20269 to its Known Exploited Vulnerabilities catalogue on 13 September 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What “being exploited in the wild” means for this Cisco ASA and FTD CVE

This is not a theoretical finding or a scanner-only advisory. For a network edge product, “exploited in the wild” means the vulnerable appliance may already have been reached by an attacker before defenders can schedule normal maintenance. The first practical question is therefore not whether the CVE exists, but whether any internet-facing Cisco firewall or VPN instance is exposed and reachable.

Because these devices often sit at a trust boundary, exposure can include management interfaces, remote access portals, and any path that an attacker can use to probe the appliance directly. In practice, that means asset inventory and exposure confirmation matter as much as the CVE name itself.

How to respond when patching cannot wait

The operational response is straightforward: confirm whether the appliance is internet-facing, apply the vendor fix or CISA-recommended mitigation as soon as possible, and if remediation is delayed, reduce exposure immediately by restricting access to the smallest possible set of trusted sources. For edge appliances, delay is dangerous because attackers usually need only a brief window to start scanning and testing public targets.

If you cannot patch at once, treat compensating controls as temporary risk reduction rather than a substitute for repair. That usually means narrowing remote administration paths, reviewing whether the device is still needed in its current role, and ensuring any exposed service is isolated from broader internal access where possible.

What to look for after suspected exploitation

After confirming exposure, assume the next question is whether the appliance was used as an initial foothold. Review authentication logs, configuration changes, unusual management access, new accounts or altered access rules, and any signs that the device was used to pivot deeper into the environment. If the firewall or VPN appliance protects privileged access, compromise can quickly become a broader network incident.

Where the device handled remote sessions, credential-bearing traffic, or administrative access, also consider whether sessions, secrets, or trust relationships could have been exposed. That is especially important if you find evidence of abnormal login activity, unexpected configuration exports, or signs that the appliance was used outside its normal operating pattern.

Risk and Threat Considerations

Internet-facing security appliances are attractive because they sit at the boundary between unauthenticated external traffic and trusted internal networks. Once attackers have reliable exploitation evidence, they typically focus on reconnaissance, credential capture, configuration abuse, and lateral movement rather than noisy disruption, because the appliance can become a durable entry point.

Failure mechanism: The flaw can be used to reach the appliance directly, obtain unauthorized access, and then leverage the device’s trust position to inspect traffic, alter configuration, or move toward internal resources before defenders notice.

Impact: The likely consequence is not limited to the appliance itself. Compromise can expose internal segmentation, VPN access, administrative sessions, and downstream systems that rely on the firewall or remote-access service as a control point.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-17 — Remote Access	Remote-access edge appliances need tightly controlled external entry paths.
	IA-5 — Authenticator Management	Exploitation may expose or abuse authenticators handled by the device.
Recommendation — Restrict and monitor remote access paths exposed by the appliance. Rotate and invalidate any exposed or suspect authenticators immediately.
CIS Controls v8	CIS-6 — Access Control Management	Urgent remediation depends on reducing exposed access paths and privileges.
	CIS-8 — Audit Log Management	Post-exploitation review requires logging visibility on the affected device.
Recommendation — Remove unnecessary access paths and tighten privileged access to the appliance. Centralise and review appliance logs for signs of exploitation or pivoting.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The question is about active exploitation of a public-facing Cisco appliance vulnerability.
Recommendation — Hunt for exploitation attempts against the public-facing appliance and related access paths.

Practitioner Guidance

What to prioritise: Treat exposure assessment as the first decision point. If the appliance is reachable from the internet or supports remote administration, assume it belongs in the highest-priority remediation queue until you have verified patch or mitigation status.

What to verify: Check whether the device is still in active use, whether management access is restricted, and whether logs show suspicious authentication, configuration, or session activity around the exploitation window. If you find any credible sign of compromise, expand the scope to adjacent systems that depend on the appliance for access.

Practitioner takeaway: For edge-security CVEs, the real risk is often not just initial access, but the appliance’s position as a trust concentrator, so remediation should be paired with compromise review rather than treated as a simple patching task.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org