Live › vulnerability › CVE-2026-76524
Go to dashboardSnort 3's control channel socket does not check authentication for local connections. A local user with low privileges can connect to it and run arbitrary commands as the Snort 3 process user, and read and write its memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running Open Source Snort 3 where local, non-privileged users or processes can reach the control channel socket. Systems without Snort 3, or where only trusted administrators have local shell access, face lower practical risk. Remote attackers are not described as able to exploit this.
No product ranges from the sources yet.
snort --version to see the installed Snort 3 version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.
This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-76524")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.