CVE-2020-3433
CISA KEVPublished October 24, 2022 · Updated April 3, 2026
high
Official Description+
Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
Affected Products
| Vendor | Product |
|---|---|
| Cisco | AnyConnect Secure |
Patch Status
Patch by 2022-11-14
Recommended Actions
- Check if your systems use any of the affected products listed above.
- Apply vendor patches immediately if available.
- This vulnerability is in CISA's Known Exploited Vulnerabilities catalog — prioritize remediation.
- Monitor vendor advisories for updates and additional mitigations.
- Review logs for indicators of compromise related to CVE-2020-3433.