Cisco Fixes 13 Snort 3 Vulnerabilities, Including CVSS 9.0 Out-of-Bounds Write

TL;DR

On October 21, 2026, Cisco published seven advisories that fix 13 Snort 3 vulnerabilities across its firewall and security products. The worst, CVE-2026-20043, is a CVSS 9.0 out-of-bounds write found through internal testing. Most of the other bugs let a remote attacker crash the Snort 3 Detection Engine, causing denial of service.

Notable CVEs

Why It Matters

Snort 3 is the intrusion prevention engine inside many Cisco products. It inspects traffic on Secure Firewall Threat Defense (FTD), Meraki MX appliances, Cyber Vision and UTD on Cisco IOS XE. It also powers Cisco’s cloud firewall and Secure Access services.

When the engine restarts, inspection stops for a moment. Depending on settings, traffic may then pass uninspected or drop entirely. In other words, a crash can mean either a blind spot or an outage.

AI helped find several bugs

Cisco says it found the hardening bugs “using existing testing processes as well as frontier AI models.” In addition, researcher Michael Bommarito reported four denial of service flaws “with assistance from Claude AI.”

How the Attacks Work

Security hardening release

The Snort 3 security hardening advisory groups internal findings by weakness type. Each CVE score reflects “the single most impactful underlying vulnerability” in that group.

• CVE-2026-20043 (9.0): out-of-bounds write
• CVE-2026-20236: incorrect calculation
• CVE-2026-20291 (7.8): improper privilege management
• CVE-2026-20356 (7.5): uncontrolled resource consumption

Cisco does not describe the individual bugs. However, it notes that it “may publish separate security advisories” with more detail later.

Local command execution

CVE-2026-76524 (CVSS 7.8) affects the open-source Snort 3 control channel. According to the Snort 3 control channel advisory, the flaw stems from “a lack of authentication when a local user connects.” A low-privileged local user could then run commands as the Snort process user. They could also read and write Snort process memory.

Remote denial of service flaws

The remaining Snort 3 vulnerabilities let an unauthenticated, remote attacker send crafted traffic through an affected device. Each one forces the detection engine to restart.

• VBA decompression (CVE-2026-20218): the VBA buffer overflow advisory cites “improper range checking” that can overflow stack data.
• NetFlow, GRE, Teredo and file processing: the Snort 3 multiple DoS advisory covers four parsing and memory exhaustion bugs. One NetFlow flaw needs just “a single crafted Netflow packet.”
• SMTP MIME (CVE-2026-20011): the SMTP MIME decoder advisory blames “a lack of error checking” in header parsing.
• GTP codec (CVE-2026-76445): the GTP codec advisory describes crafted, fragmented UDP traffic that traps the engine in an infinite loop.
• Nested GRE (CVE-2026-20221): the GRE tunnel advisory warns of “either a bypass or denial of service (DoS) condition, depending on device configuration.”

The engine restarts on its own. Even so, repeated attacks could keep inspection offline.

Exploitation status

For all seven advisories, Cisco PSIRT “is not aware of any public announcements or malicious use.” None of these CVEs appears in CISA’s Known Exploited Vulnerabilities catalog. No public proof-of-concept has been confirmed.

Who found the bugs

Outside researchers reported many of these Snort 3 vulnerabilities. Pulkit Sanadhya and Yazan Balawneh of CyStack.ps found the control channel flaw. Yazdan Soltani reported the GTP bug. Five researchers flagged the VBA overflow, including one working with the TrendAI Zero Day Initiative. By contrast, Cisco found the GRE and SMTP MIME flaws while solving customer support cases.

Affected Versions

Open Source Snort 3 releases before 3.12.4.0 are affected. Cisco FTD, Cyber Vision and UTD on IOS XE also ship vulnerable builds. Open Source Snort 2 is not affected, though it has reached end of life.

Patch and Mitigation Steps

• Upgrade Open Source Snort 3 to 3.12.4.0 or later.
• Update FTD to fixed releases such as 7.2.12, 7.4.8, 7.6.6, 7.7.13 or 10.0.2.
• For UTD on IOS XE, move to 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1.
• Upgrade Cyber Vision to 5.6.0 or a later fixed release.
• Confirm that online Meraki MX devices received the automatic update.
• If you cannot patch, keep VBA decompression disabled. It is off by default.

Cloud-delivered Firewall and Secure Access instances need no action, since Cisco updated them on October 21. Most of these Snort 3 vulnerabilities have no workaround, so patching remains the main fix. Teams should also review Snort Fail Open settings to understand how traffic behaves during an engine restart.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.