Can DH_anon really be exploited by an attacker? General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run into a client that supports DH or ECDH_anon. Could an attacker really leverage this to pull off a successful attack (with no errors/warnings?)
Ensuring that you're talking to the correct server is the client's duty. They need to verify the certificate and reject anonymous DH.

A client that accepts anon DH or doesn't verify the server's certificate is always vulnerable to MitM, even if the server disables anon DH.

Thus disabling anonymous DH on the server has little effect on security, beyond encouraging clients to choose proper ciphersuites. In the context of web applications, all popular browsers do not support anon DH to "secure" https.