EUVD-2026-107377
GHSA-ghjc-g92q-hx65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local foothold
-
ExploitAbuse improper privilege management in Snort 3
-
ImpactEscalate to root/admin on security appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated low-privilege access (PR:L) to a device running the affected Snort 3 engine - i.e., a Cisco Secure Firewall Threat Defense (FTD), UTD Snort IPS Engine, Cisco Cyber Vision deployment, or an Open Source Snort 3 installation. There is no network-reachable attack surface (AV:L) and no user interaction is needed (UI:N) once local access is held. The principal limiting factor is this prerequisite foothold: the flaw cannot be triggered remotely or by an unauthenticated actor, so realistic risk is confined to post-compromise escalation or malicious/compromised low-privilege local accounts on the appliance. |
| Impact | This is a genuine but operationally-bounded risk rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a local privilege-escalation flaw (consistent with CWE-269, improper privilege management): an attacker needs to already be on the host with low privileges, but once there, exploitation is low-complexity, requires no user interaction, and yields full confidentiality, integrity, and availability impact - classic local root/admin escalation. No EPSS score, CISA KEV listing, or public POC was provided in the input, and the vulnerability was found through Cisco's own internal security review rather than observed attacks, which is consistent with no public exploit being available yet. The signals are internally consistent - there is no network-vs-local conflict here - so the main caveat is simply that this requires pre-existing local access, meaning it is a post-compromise/insider escalation primitive rather than an initial-access or wormable bug. Because the affected components (Snort 3, FTD, UTD, Cyber Vision) are security-enforcement appliances, successful escalation on them is high-value (defeating the defensive control itself), which raises priority above a typical local EoP despite the absence of exploitation evidence. |
| Exploit ScenarioDerived | An attacker who has already obtained a low-privileged foothold on a device running the Snort 3 engine (e.g., a limited shell on a Cisco FTD appliance or a compromised low-privilege service account) abuses the improper privilege management flaw to escalate to higher/root-level privileges. No user interaction is required and attack complexity is low. No public exploit code was identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
RemediationAI
Apply the Cisco hardening release identified in the vendor advisory for each affected product: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe. The input does not provide an exact fixed version string, so patch availability is per the Cisco advisory and the precise release must be taken from that advisory rather than inferred. Until patched, restrict local console and SSH access to trusted administrators, remove or disable unnecessary low-privilege local accounts, enforce least privilege on appliance accounts, and monitor for unexpected privilege changes; these controls reduce the likelihood of a local user reaching the vulnerable privilege-management path but do not remove the flaw for legitimate low-privileged users and may add administrative overhead or complicate troubleshooting. Because exploitation requires local access, network-perimeter filtering alone is not a direct mitigation, but segregating management interfaces from untrusted networks can limit who obtains the prerequisite foothold.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is the open-source intrusion prevention and detection engine embedded in several Cisco security products; the CPE data identifies Cisco Cyber Vision, Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software as in scope. The root cause is CWE-269 improper privilege management, meaning the software does not correctly assign, drop, or restrict privileges, so a local user with low privileges can perform actions reserved for a higher-privileged context. The assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector confirms the attack is local, requires low privileges, needs no user interaction, and can result in high confidentiality, integrity, and availability impact once the prerequisite local access exists.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Improper privilege management is exploited locally by an already-authenticated low-privilege user (AV:L/PR:L), with no interaction and low complexity, yielding full root-level C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.
Executive ViewAI
Cisco Snort 3 underpins several security enforcement and visibility products, and this flaw allows an attacker with an existing low-privilege local account to elevate privileges on those systems. Leadership should care because a minor local compromise could expand into control of network security infrastructure, enabling policy tampering, defense bypass, or broader access. The issue is local-only with no public exploit identified at time of analysis, but the absence of a vendor-released patch makes risk-based mitigation important.
No vendor-released patch identified at time of analysis. Restrict and monitor local access, remove unnecessary local accounts, enforce least privilege and audit privilege assignments, segment management interfaces, deploy security monitoring for privilege escalation, and apply vendor guidance as it becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB