CVE-2014-8021: Cross-site scripting (XSS) vulnerability in Cisco AnyConnect Secure Mobility Client 3.1(.02043) and earlier...

Security readout for executives and security teams

CVE-2014-8021 is an older Cisco web-launch cross-site scripting issue affecting Cisco AnyConnect Secure Mobility Client and Cisco HostScan Engine. A remote attacker could inject script or HTML through an applet-path URL. The sources do not provide CVSS, confirmed exploitation, or detailed fix versions in the supplied bundle. Exposure is likely limited to organizations still running these legacy Cisco AnyConnect or HostScan versions, especially where web launch flows remain reachable. Modern environments may be unaffected if they have retired these versions or upgraded long ago. Treat this as a cleanup and legacy remote-access risk item unless affected versions are still internet-facing. Prioritize verification because VPN and endpoint posture tooling are sensitive access paths, but the supplied evidence does not support emergency exploitation claims. Mitigation focus: Inventory Cisco AnyConnect and HostScan versions in remote access environments.; Check Cisco advisory guidance for affected and corrected releases.; Upgrade or retire affected legacy versions according to Cisco guidance..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.