EUVD-2026-107379
GHSA-48pq-hvmp-558r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach sensor in traffic path
-
DeliverySend crafted network packets
-
ExploitTrigger incorrect calculation in Snort 3
-
ExecutionCrash inspection engine
-
ImpactDenial of service on protected traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Exploitation requires that a Snort 3-based inspection engine actively process the attacker's traffic - i.e. the sensor is deployed inline or monitoring a path the attacker can reach (Cisco Secure Firewall Threat Defense, UTD Snort IPS engine, Cyber Vision, or open-source Snort 3 inspecting the relevant protocol). No authentication or user interaction is needed (PR:N/UI:N) and complexity is low (AC:L), so default inspecting configurations are exposed. The practical limiting factor is reachability: the attacker must be able to steer crafted traffic of the affected protocol/content type through the sensor, and impact is confined to availability (engine crash/DoS) with no confidentiality or integrity effect; exact vulnerable versions must be confirmed against the Cisco advisory. |
| Impact | CVSS 3.1 scores this 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - remote, unauthenticated, low-complexity, with availability-only impact (C:N/I:N), i.e. a denial-of-service condition rather than data compromise or code execution. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The underlying weakness is CWE-682 (Incorrect Calculation), consistent with a parsing/length-math error in the Snort 3 inspection engine that an attacker crashes by sending traffic through the sensor. Notably, the input Tag 'Information Disclosure' directly conflicts with the CVSS vector's C:N (no confidentiality impact); the vector indicates DoS, not disclosure - treat the tag as unreliable and the real impact as availability loss. This is a genuine but moderate priority: because the affected Snort engine underpins Cisco Secure Firewall Threat Defense (FTD), UTD Snort IPS, Cyber Vision and open-source Snort 3, a crash can take an inline security control offline, but absence of exploit signals and the DoS-only impact place it below RCE/credential-theft class issues. Severity and affected-version detail should be confirmed against the Cisco advisory (cisco-sa-hardening-snort3). |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted network traffic that transits a Snort 3-based sensor (e.g. a Cisco FTD firewall or UTD IPS engine in the traffic path). The incorrect-calculation flaw in packet/protocol processing is triggered, crashing or hanging the inspection engine and causing a denial of service that can disrupt traffic inspection or connectivity. No public proof-of-concept is available in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
RemediationAI
Patch status: Patch available per vendor advisory; Cisco states that software hardening releases address the multiple internally discovered Snort 3 calculation vulnerabilities, but exact fixed version numbers are not provided in the supplied data, so administrators should use the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe to identify and upgrade Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, and Cisco Cyber Vision to the listed fixed releases. If immediate upgrade is not possible, configure inline Snort 3, FTD, or UTD inspection paths for fail-open or bypass so a crash of the inspection engine does not cause a denial of service to protected traffic, accepting reduced inspection coverage while the sensor is unavailable. Additionally, limit which networks can steer traffic through the affected sensor and monitor for engine crashes or reloads, accepting reduced visibility or reachability as a trade-off; isolating or removing unnecessary inline inspection from untrusted paths reduces exposure but may weaken detection and prevention for those paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is Cisco's open-source intrusion prevention and detection engine that is also embedded in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and Cisco Cyber Vision. CWE-682 (Incorrect Calculation) covers arithmetic or size, length, and offset calculation mistakes that can result in unsafe processing when the engine parses inspected traffic; Cisco groups multiple internally discovered issues of this class under CVE-2026-20236. The CPE list uses wildcard versions for cisco_open_source_snort3, cisco_secure_firewall_threat_defense_(ftd)_software, cisco_utd_snort_ips_engine_software, and cisco_cyber_vision, so vulnerable and fixed version boundaries must be taken from the Cisco advisory rather than inferred from the supplied CPE strings. The assessed vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation with no user interaction, while S:U/C:N/I:N/A:H confines demonstrated impact to availability, such as an engine crash or denial of service. The supplied tag includes Information Disclosure, but the authoritative CVSS vector records C:N, so this synthesis does not assert a confidentiality impact.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Snort inspects attacker-reachable network traffic with no auth or interaction (AV:N/AC:L/PR:N/UI:N); the incorrect-calculation flaw crashes the engine, so A:H with C:N/I:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.
Executive ViewAI
CVE-2026-20236 exposes Cisco's Snort 3-based inspection stack-including Secure Firewall Threat Defense, UTD Snort IPS, Cyber Vision, and open-source Snort 3-to unauthenticated remote disruption through crafted traffic. Because these systems sit in line with critical network flows, a successful denial-of-service condition can degrade network availability and reduce the inspection visibility security teams rely on, affecting both operations and security monitoring. Leadership should prioritize inventory, exposure reduction, and vendor workarounds until a fixed release is available.
No vendor patch is available; restrict exposure and management access for affected Cisco Secure Firewall Threat Defense, UTD Snort IPS, Cyber Vision, and open-source Snort 3 sensors, segment or rate-limit traffic to inspection engines, deploy redundant/failover capacity, enable crash and health monitoring, and apply Cisco advisory workarounds until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB