Read the docs
TI-2016-07521 Aliases CVE-2016-9192GHSA-pw88-gjwv-2cw5

Access control flaw in Cisco AnyConnect Secure Mobility Client

Priority MEDIUM 40CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More Information: CSCvb68043. Known Affected Releases: 4.3(2039) 4.3(748). Known Fixed Releases: 4.3(4019) 4.4(225).

Why it matters now

EPSS 0.03473 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco AnyConnect Secure Mobility ClientCisco AnyConnect Secure Mobility Client—No fix listedCNA
  • Cisco AnyConnect Secure Mobility Client Vendor— Affected Cisco AnyConnect Secure Mobility Client Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1\(60\):*:*:*:*:*:*:*3.1(60)VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.02043:*:*:*:*:*:*:*3.1.02043VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05182:*:*:*:*:*:*:*3.1.05182VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05187:*:*:*:*:*:*:*3.1.05187VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.06073:*:*:*:*:*:*:*3.1.06073VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.07021:*:*:*:*:*:*:*3.1.07021VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(48\):*:*:*:*:*:*:*4.0(48)VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(64\):*:*:*:*:*:*:*4.0(64)VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(2049\):*:*:*:*:*:*:*4.0(2049)VulnerableCisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1\(60\):*:*:*:*:*:*:* Versions 3.1(60) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.02043:*:*:*:*:*:*:* Versions 3.1.02043 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05182:*:*:*:*:*:*:* Versions 3.1.05182 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.05187:*:*:*:*:*:*:* Versions 3.1.05187 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.06073:*:*:*:*:*:*:* Versions 3.1.06073 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.1.07021:*:*:*:*:*:*:* Versions 3.1.07021 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(48\):*:*:*:*:*:*:* Versions 4.0(48) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(64\):*:*:*:*:*:*:* Versions 4.0(64) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0\(2049\):*:*:*:*:*:*:* Versions 4.0(2049) Vulnerable ·Cisco
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00048:*:*:*:*:*:*:*4.0.00048VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00051:*:*:*:*:*:*:*4.0.00051VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1\(8\):*:*:*:*:*:*:*4.1(8)VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.04039:*:*:*:*:*:*:*4.2.04039VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.00748:*:*:*:*:*:*:*4.3.00748VulnerableCisco
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.01095:*:*:*:*:*:*:*4.3.01095VulnerableCisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00048:*:*:*:*:*:*:* Versions 4.0.00048 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.0.00051:*:*:*:*:*:*:* Versions 4.0.00051 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1\(8\):*:*:*:*:*:*:* Versions 4.1(8) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.2.04039:*:*:*:*:*:*:* Versions 4.2.04039 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.00748:*:*:*:*:*:*:* Versions 4.3.00748 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.3.01095:*:*:*:*:*:*:* Versions 4.3.01095 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9192
  2. 2026-10-03 Alias added: GHSA-pw88-gjwv-2cw5

References

Advisory 1

Other 2

  • TI-2020-02982 Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability KEVCVSS 3.1HIGH 7.8
  • TI-2020-02715 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability KEVCVSS 3.1MEDIUM 6.5
  • TI-2011-01789 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 7.6
  • TI-2011-01790 The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect… CVSS 2.0HIGH 9.3
  • TI-2012-02179 The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure… CVSS 2.0HIGH 9.3
  • TI-2023-06884 Incorrect default permissions in Cisco Secure Client CVSS 3.1HIGH 7.8
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences