CVE-2023-20185
A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerability is due to an issue with the implementation of the ciphers that are used by the CloudSec encryption feature on affected switches. An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to read or modify the traffic that is transmitted between the sites. Cisco has deprecated and removed the ACI Multi-Site CloudSec encryption feature that is affected by this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX Security Impact Rating: High CVE: CVE-2023-20185
CSIRTS triage
- What
- A vulnerability could allow an unauthenticated attacker to read or modify intersite encrypted traffic.
- Who is affected
- Users of Cisco Nexus 9000 Series Fabric Switches in ACI mode.
- Urgency
- High urgency due to the potential for significant data exposure.
- Action
- Since the affected feature has been deprecated, ensure that it is no longer in use.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2023-20185
Get an email if CVE-2023-20185 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Advisory coverage (1)
- highCisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerabilitycisco-psirt · 2026-04-24
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2023-20185)