Act nowDisclosed

Advisory · CVE-2026-20043

Cisco Snort 3 out-of-bounds write grouping affects Snort 3, Secure Firewall Threat Defense and Cyber Vision

Cisco grouped out-of-bounds write issues under CVE-2026-20043 in a Snort 3 hardening release affecting Open Source Snort 3 and Cisco products that embed it, including Secure Firewall Threat Defense, Cyber Vision and the UTD Snort IPS engine, with fixed releases listed in the Cisco advisory. CVSS 3.1 9.0.

Advisory published October 21, 2026Independent summary
Vendor
Cisco
Product
Snort 3
Identifier / CWE
CVE-2026-20043
CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

The intrusion prevention engine that inspects traffic can write past the memory it set aside when it handles certain traffic, so the sensor that is supposed to stop attacks can itself be attacked through the traffic it inspects.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted traffic reaches inspection

    Traffic handled by a Snort 3 based sensor or firewall reaches the affected inspection code.

  2. 02Out-of-bounds write occurs

    Per the Cisco grouping for this CVE, the affected issues are out-of-bounds writes, tracked under CWE-787.

  3. 03Sensor memory is corrupted

    The write goes past the intended buffer in the inspection process.

  4. 04Impact in the sensor context

    Cisco scores this grouping with changed scope and high confidentiality, integrity and availability impact at CVSS 3.1 9.0, with a network attack vector and no privileges or user interaction required.

What happened

Cisco disclosed CVE-2026-20043 as part of a Snort 3 security hardening release: the Snort 3 engineering team conducted an internal security review that resulted in hardening releases addressing multiple internally discovered vulnerabilities, and Cisco grouped the issues tracked by this CVE under out-of-bounds writes (CWE-787). The NVD record lists affected products including Cisco Cyber Vision, Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software and the Cisco UTD Snort IPS Engine Software. The CVSS 3.1 score is 9.0, with network attack vector, high complexity, no privileges, no user interaction, and changed scope. Cisco states in the advisory that it strongly recommends customers upgrade to the fixed software indicated in the advisory.

Per the Cisco advisory, the first fixed release for Open Source Snort 3 is 3.12.4.0; for Cisco Secure FTD Software the first fixed releases are 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 for their respective trains; for the UTD engine on Cisco IOS XE Software they are 17.12.8, 17.15.6, 17.18.5, 26.1.2 and 26.2.1; and for Cisco Cyber Vision, releases earlier than 5.6 should migrate to a fixed release and 5.6 is fixed in 5.6.0. Cisco also states that Cisco CDFW and CSA cloud instances and online Meraki MX appliances were automatically updated with the Snort 3 package as of October 21, 2026, with no customer action required for those services.

What to do

  1. Inventory Snort 3 sensors and every Cisco product that embeds Snort 3, including Secure FTD, Cyber Vision, UTD on IOS XE, Meraki MX and any standalone open source Snort 3 deployment, and note the version of each.
  2. Upgrade affected systems to the first fixed release for their train as listed in the Cisco advisory, including Snort 3 3.12.4.0 for standalone Snort 3.
  3. Confirm that cloud managed CDFW, CSA and Meraki MX instances in your estate actually show the updated Snort 3 package, rather than assuming the automatic update reached offline or disconnected devices.
  4. Keep Snort 3 sensors and firewall management interfaces off untrusted networks while remediation is underway.
  5. Hunt for Snort process crashes, restarts, and inspection gaps around the time window before the upgrade, especially on sensors handling untrusted traffic.
  6. Verify the deployed version after updating on every sensor, including high availability peers and standalone sensors.

Management note

Snort sits in the traffic path as a security control, and a memory write flaw in the inspector undermines the control itself. Upgrade sensors and firewalls on the fixed trains Cisco lists, and verify the supposedly automatic cloud updates actually landed.