{"id":"CVE-2026-20236","kind":"vulnerability","aliases":["CVE-2026-20236"],"related":[],"title":"Snort 3: hardening fixes for internal flaws in incorrect calculation","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.","summary":"Cisco's Snort 3 network intrusion detection software has several internally found flaws in incorrect calculation logic (CWE-682), fixed in hardening releases. The sources do not say what an attacker can do with them.","severity":"high","cvss":7.5,"epss":0.00346,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-security","self-hosted","snort"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Move Snort 3 to a hardening release that includes the fix, per Cisco's advisory (version not stated in the sources)","status":"open","published_at":"2026-10-21T17:18:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:33+00:00","updated_at":"2026-10-25T03:16:33+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T03:16:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move Snort 3 to a hardening release that includes the fix, per Cisco's advisory (version not stated in the sources)","reach":"unknown","title":"Snort 3: hardening fixes for internal flaws in incorrect calculation","impact":"medium","summary":"Cisco's Snort 3 network intrusion detection software has several internally found flaws in incorrect calculation logic (CWE-682), fixed in hardening releases. The sources do not say what an attacker can do with them.","category":"infrastructure","nicknames":[],"who_cares":["snort","self-hosted","network-security"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Read Cisco's advisory for affected Snort 3 versions, the fixed release and the impact of the CWE-682 flaws; the NVD entry gives only the CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Snort 3 as an intrusion detection or prevention engine are the ones to check. The sources do not say which configurations or versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00056,"input_tokens":3423,"output_tokens":436,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-20236':13A,16A,105C '-2026':12A,15A,104C '-682':43B,124C '3':2A,28B,75C 'address':94C 'attack':55B 'base':122C 'calcul':10A,40B,112C 'cisco':25B,59C,70C 'commit':62C 'common':118C 'comprehens':82C 'concern':110C 'conduct':80C 'cve':11A,14A,103C 'cwe':42B,121C,123C 'detect':31B 'discov':97C 'engin':77C 'enumer':120C 'fix':4A,44B 'flaw':7A,37B 'found':36B 'group':115C 'harden':3A,46B,91C 'host':23B 'incorrect':9A,39B,111C 'infrastructur':17B 'intern':6A,35B,83C,96C 'intrus':30B 'issu':109C 'logic':41B 'multipl':95C 'network':19B,29B 'network-secur':18B 'ongo':61C 'open':72C 'own':71C 'part':57C 'proactiv':64C 'product':67C 'qualiti':68C 'relat':107C 'releas':47B,92C 'result':88C 'review':85C,87C 'say':52B 'secur':20B,65C,84C 'self':22B 'self-host':21B 'sever':34B 'snort':1A,24B,27B,74C 'softwar':32B,76C,90C 'sourc':49B,73C 'team':78C 'track':101C 'vulner':98C,100C 'weak':119C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Snort 3 as an intrusion detection or prevention engine are the ones to check. The sources do not say which configurations or versions are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20236","severity":null,"published_at":"2026-10-21T17:18:28+00:00","modified_at":"2026-10-22T14:17:41+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-20236","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20236","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}