CVE-2023-20269: Cisco Adaptive Security Appliance (ASA) Software · Authentication Bypass Using an Alternate Path or Channel
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Exploited in the wild · used in ransomware campaigns · KEV due 4 Oct 2023 · 26% EPSS · end of life, no fix coming : replace or isolate Cisco Adaptive Security Appliance (ASA) Software; no fix will be released.
Data as of 25 Oct 2026, 19:02 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
- Ransomware
- Used in ransomware campaigns
- EPSS
- 26.6% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- None coming – the product is end of life
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NExploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 6 Sep 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 7 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by cisco
, 314 days before disclosure
CVE published
on cve.org
, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
, 7 days after disclosure
KEV remediation due
US federal deadline
, 28 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
No fix will be released: Cisco Adaptive Security Appliance (ASA) Software is end of life. Replace it, or isolate it from untrusted networks until you can.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
Check the firmware or software version for Cisco Adaptive Security Appliance (ASA) Software in the device's admin interface against the vendor advisory.
Description
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.