--- id: "CVE-2026-20043" kind: "vulnerability" aliases: ["CVE-2026-20043"] title: "Snort 3: out-of-bounds writes in Cisco firewall and IOS XE inspection engine" severity: "critical" cvss: 9.0 epss: 0.00264 exploited: false status: "open" category: "package" products: [{"name": "Snort 3", "fixed": ["3.12.4.0"], "affected": "3.x < 3.12.4.0", "ecosystem": "vendor"}, {"name": "Cisco Secure Firewall Threat Defense (FTD)", "fixed": ["7.0.10", "7.2.12", "7.4.8", "7.6.6", "7.7.13", "10.0.2", "10.1.0"], "affected": "<= 7.0 (before 7.0.10), 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2", "ecosystem": "vendor"}, {"name": "Cisco Cyber Vision", "fixed": ["5.6.0"], "affected": "< 5.6.0", "ecosystem": "vendor"}, {"name": "Cisco IOS XE UTD", "fixed": ["17.12.8", "17.15.6", "17.18.5", "26.1.2", "26.2.1"], "affected": "17.12 < 17.12.8, 17.15 < 17.15.6, 17.18 < 17.18.5, 26.1 < 26.1.2, 26.2 < 26.2.1", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cisco", "cisco ftd", "cyber vision", "cyber-vision", "ftd", "ios-xe", "ios-xe utd", "meraki", "package", "self-hosted", "snort", "snort 3", "snort3"] not_affected_if: ["managed-hosting", "snort2", "unknown"] published_at: "2026-10-21T17:18:27+00:00" first_seen_at: "2026-10-23T21:57:29+00:00" updated_at: "2026-10-24T13:15:54+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20043", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:29:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:50:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-20043", "first_seen_at": "2026-10-24T13:15:54+00:00"}] --- # Snort 3: out-of-bounds writes in Cisco firewall and IOS XE inspection engine Snort 3, the intrusion-prevention engine in Cisco Secure FTD, IOS XE UTD, Cyber Vision, Meraki MX, CDFW and CSA, has out-of-bounds write bugs (CWE-787) that Cisco found in internal testing. The worst scores CVSS 9.0: network-reachable, no auth, high complexity. Cisco says products are affected regardless of configuration, has no workaround, and knows of no exploitation. The exact traffic that triggers the bugs is not published. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Snort 3 affected 3.x < 3.12.4.0 fixed 3.12.4.0 - vendor:Cisco Secure Firewall Threat Defense (FTD) affected <= 7.0 (before 7.0.10), 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2 fixed 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0 - vendor:Cisco Cyber Vision affected < 5.6.0 fixed 5.6.0 - vendor:Cisco IOS XE UTD affected 17.12 < 17.12.8, 17.15 < 17.15.6, 17.18 < 17.18.5, 26.1 < 26.1.2, 26.2 < 26.2.1 fixed 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1 ## How to check Open source Snort 3: run 'snort -V'; anything older than 3.12.4.0 is affected (Snort 2 is not). FTD: check the version in FMC or with 'show version'. IOS XE: 'show version' and the secapp-utd package version. Cyber Vision: check the release. Cisco says all listed products are affected regardless of configuration, so inspection policy does not change exposure. Meraki MX, CDFW and CSA were updated by Cisco as of Oct 21. ## Fix Upgrade Snort 3 to 3.12.4.0 or later; for Cisco products, move to the fixed releases: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0; Cyber Vision 5.6.0; IOS XE UTD 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1. ## Timeline - 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20043 - 2026-10-23T22:29:38+00:00 analyst — Read Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe (v1.1, Oct 22). Grouped CWE-787 CVE, max CVSS 9.0; no per-bug trigger published; no workaround; no known exploitation or PoC. Sibling CVEs in the same advisory: 20236, 20291, 20356. No community search done (fresh, grouped advisory). - 2026-10-23T22:50:34+00:00 analyst — No new sources since run 236. Triage pass overwrote how_to_check and not_affected_if; restored from the Cisco advisory. Answer to triage question: advisory says affected 'regardless of device configuration', CVSS PR:N so no auth; the traffic path is not published. - 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-20043 ## Documents - [advisory] Cisco: Snort 3 Security Hardening Release: October 2026 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-hardening-snort3-ybgmhTQe.html ## From the sources As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_