{"id":"CVE-2026-20043","kind":"vulnerability","aliases":["CVE-2026-20043"],"related":[],"title":"Snort 3: out-of-bounds writes in Cisco firewall and IOS XE inspection engine","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.","summary":"Snort 3, the intrusion-prevention engine in Cisco Secure FTD, IOS XE UTD, Cyber Vision, Meraki MX, CDFW and CSA, has out-of-bounds write bugs (CWE-787) that Cisco found in internal testing. The worst scores CVSS 9.0: network-reachable, no auth, high complexity. Cisco says products are affected regardless of configuration, has no workaround, and knows of no exploitation. The exact traffic that triggers the bugs is not published.","severity":"critical","cvss":9.0,"epss":0.00264,"exploited":false,"exploited_at":null,"products":[{"name":"Snort 3","fixed":["3.12.4.0"],"affected":"3.x < 3.12.4.0","ecosystem":"vendor"},{"name":"Cisco Secure Firewall Threat Defense (FTD)","fixed":["7.0.10","7.2.12","7.4.8","7.6.6","7.7.13","10.0.2","10.1.0"],"affected":"<= 7.0 (before 7.0.10), 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2","ecosystem":"vendor"},{"name":"Cisco Cyber Vision","fixed":["5.6.0"],"affected":"< 5.6.0","ecosystem":"vendor"},{"name":"Cisco IOS XE UTD","fixed":["17.12.8","17.15.6","17.18.5","26.1.2","26.2.1"],"affected":"17.12 < 17.12.8, 17.15 < 17.15.6, 17.18 < 17.18.5, 26.1 < 26.1.2, 26.2 < 26.2.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","cisco ftd","cyber vision","cyber-vision","ftd","ios-xe","ios-xe utd","meraki","package","self-hosted","snort","snort 3","snort3"],"not_affected_if":["managed-hosting","snort2","unknown"],"how_to_check":"Open source Snort 3: run 'snort -V'; anything older than 3.12.4.0 is affected (Snort 2 is not). FTD: check the version in FMC or with 'show version'. IOS XE: 'show version' and the secapp-utd package version. Cyber Vision: check the release. Cisco says all listed products are affected regardless of configuration, so inspection policy does not change exposure. Meraki MX, CDFW and CSA were updated by Cisco as of Oct 21.","fix":"Upgrade Snort 3 to 3.12.4.0 or later; for Cisco products, move to the fixed releases: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0; Cyber Vision 5.6.0; IOS XE UTD 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1.","status":"open","published_at":"2026-10-21T17:18:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:11+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Snort 3 to 3.12.4.0 or later; for Cisco products, move to the fixed releases: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0; Cyber Vision 5.6.0; IOS XE UTD 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1.","reach":"network","title":"Snort 3: out-of-bounds writes in Cisco firewall and IOS XE inspection engine","impact":"high","summary":"Snort 3, the intrusion-prevention engine used by Cisco Firewall Threat Defense, IOS XE UTD and Cyber Vision, has memory out-of-bounds write flaws found in an internal review. The sources do not say exactly what an attacker can send to reach them, but out-of-bounds writes can let attacker-controlled input corrupt memory and run code.","category":"package","who_cares":["snort 3","cisco ftd","ios-xe utd","cyber vision","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker may corrupt memory and run code on the device","analyst_note":"Confirm which Snort 3 traffic path triggers the out-of-bounds writes and whether auth or inspection policy is required; see the Cisco advisory linked from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-20043).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000633,"input_tokens":3374,"output_tokens":592,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which Snort 3 traffic path triggers the out-of-bounds writes and whether auth or inspection policy is required; see the Cisco advisory linked from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-20043).","search":"'-20043':18A,21A,185C '-2026':17A,20A,184C '-787':91B,207C '3':2A,23A,60B,63B,155C '9.0':102B 'address':174C 'affect':114B 'auth':107B 'base':205C 'bound':6A,87B,194C 'bug':89B,132B 'cdfw':80B 'cisco':9A,24A,30A,33A,37B,38B,70B,93B,110B,139C,150C 'commit':142C 'common':201C 'complex':109B 'comprehens':162C 'concern':190C 'conduct':160C 'configur':117B 'csa':82B 'cve':16A,19A,183C 'cvss':101B 'cwe':90B,204C,206C 'cyber':31A,40B,43B,76B 'cyber-vis':42B 'defense':28A 'discov':177C 'engin':15A,68B,157C 'enumer':203C 'exact':127B 'exploit':125B 'firewal':10A 'firewall':26A 'found':94B 'ftd':29A,39B,45B,72B 'group':198C 'harden':171C 'high':108B 'host':57B 'inspect':14A 'intern':96B,163C,176C 'intrus':66B 'intrusion-prevent':65B 'io':12A,47B,50B,73B 'ios':34A 'ios-x':46B,49B 'issu':189C 'know':122B 'meraki':53B,78B 'multipl':175C 'mx':79B 'network':104B 'network-reach':103B 'ongo':141C 'open':152C 'out-of-bound':3A,84B,191C 'own':151C 'packag':54B 'part':137C 'prevent':67B 'proactiv':144C 'product':112B,147C 'publish':135B 'qualiti':148C 'reachabl':105B 'regardless':115B 'relat':187C 'releas':172C 'result':168C 'review':165C,167C 'say':111B 'score':100B 'secur':71B,145C,164C 'secure':25A 'self':56B 'self-host':55B 'snort':1A,22A,58B,59B,62B,154C 'snort3':61B 'softwar':156C,170C 'sourc':153C 'team':158C 'test':97B 'threat':27A 'track':181C 'traffic':128B 'trigger':130B 'utd':36A,52B,75B 'vision':32A,41B,44B,77B 'vulner':178C,180C 'weak':202C 'workaround':120B 'worst':99B 'write':7A,88B,195C 'xe':13A,35A,48B,51B,74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20043","severity":null,"published_at":"2026-10-21T17:18:27+00:00","modified_at":"2026-10-22T23:18:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-20043:236","url":null,"severity":null,"published_at":"2026-10-23T22:29:38+00:00","modified_at":"2026-10-23T22:29:38+00:00","first_seen_at":"2026-10-23T22:29:38+00:00","fetched_at":"2026-10-23T22:29:38+00:00","note":"Read Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe (v1.1, Oct 22). Grouped CWE-787 CVE, max CVSS 9.0; no per-bug trigger published; no workaround; no known exploitation or PoC. Sibling CVEs in the same advisory: 20236, 20291, 20356. No community search done (fresh, grouped advisory)."},{"source":"analyst","external_id":"CVE-2026-20043:312","url":null,"severity":null,"published_at":"2026-10-23T22:50:34+00:00","modified_at":"2026-10-23T22:50:34+00:00","first_seen_at":"2026-10-23T22:50:34+00:00","fetched_at":"2026-10-23T22:50:34+00:00","note":"No new sources since run 236. Triage pass overwrote how_to_check and not_affected_if; restored from the Cisco advisory. Answer to triage question: advisory says affected 'regardless of device configuration', CVSS PR:N so no auth; the traffic path is not published."},{"source":"epss","external_id":"CVE-2026-20043","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20043","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1476,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-snort3-ybgmhTQe.html","title":"Cisco: Snort 3 Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}