EUVD-2026-107380
GHSA-6f29-xvj6-835h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device inspecting network traffic
-
DeliverySend crafted packets/flows
-
ExploitTrigger uncontrolled resource consumption in Snort3
-
ExecutionExhaust CPU/memory
-
ImpactInspection engine denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker can cause traffic to be inspected by the vulnerable Snort 3 detection engine - i.e., the target must be deployed inline/active as an IPS/IDS or firewall (Cisco Secure Firewall Threat Defense, UTD Snort IPS engine, Cisco Cyber Vision, or Open Source Snort 3) and processing attacker-influenced traffic. Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, so any unauthenticated remote source whose packets reach the inspection path can attempt it. Limiting factors: the device must actually be in a traffic-inspecting mode/path, and the impact is confined to availability (service/engine disruption) with no data exposure or code execution; exact affected versions are vendor-defined and should be confirmed against the Cisco advisory. |
| Impact | Signals are mostly consistent for a moderate-severity denial-of-service issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition, and the sole impact is availability (A:H) with no confidentiality or integrity effect (C:N/I:N) - fully aligned with CWE-400 uncontrolled resource consumption. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' The 7.5 score is driven entirely by the availability impact against a widely deployed inspection engine, not by data compromise, so this is a genuine patch-worthy issue but not a confidentiality/RCE-class crisis. Note a signal limitation: the description is deliberately vague (a bundled 'hardening' advisory covering 'multiple internally discovered vulnerabilities'), so the exact trigger packet/protocol is not disclosed - verify specifics against the Cisco advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted network traffic that transits a device running the affected Snort 3 inspection engine (e.g., a Cisco Secure Firewall Threat Defense appliance). Processing the traffic drives uncontrolled resource consumption, exhausting CPU or memory and causing the inspection engine or device to stop processing traffic, resulting in denial of service. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resources and disrupt inspection services on any deployment actively processing attacker-influenced traffic - including Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, Cisco Cyber Vision, and upstream Open Source Snort 3. The flaw is rooted in uncontrolled resource consumption (CWE-400) and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning only availability is impacted - there is no confidentiality or integrity loss and no code execution. No public exploit code or in-the-wild activity has been identified at time of analysis, and no CISA KEV listing exists; exploitation is gated by the requirement that the target actually sits inline as an IDS/IPS or firewall in a traffic-inspection path.
RemediationAI
Vendor-released patch: Cisco has published Snort 3 hardening releases addressing this and related internally discovered vulnerabilities, documented in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe - upgrade each affected platform (Open Source Snort 3, Secure Firewall FTD, UTD Snort IPS engine, Cyber Vision) to the fixed release identified there for its train, since the advisory defines version cutoffs rather than a single cross-platform build number. Where upgrading is not immediately possible, compensating controls center on reducing what reaches the vulnerable inspection path: rate-limit or police inspection-destined traffic at the perimeter and on inter-zone policies (trade-off: legitimate bursty traffic may be dropped, and the engine still sees the residual load), front the sensor with upstream ACLs or a scrubbing/proxy layer that drops malformed or abusive flows before inspection (trade-off: added latency and an additional failure domain), temporarily narrow the inspected traffic profile to essential segments or signatures (trade-off: reduced detection coverage exactly where the flaw is triggered), and segment management/inspection interfaces so only trusted source ranges can deliver traffic to the sensor (trade-off: does not help internet-facing inline deployments). Monitor Snort/FTD engine CPU and memory along with inspection drops to detect resource-exhaustion attempts, and treat repeated engine restarts as a signal to fail over or throttle. No public exploit code exists at time of analysis, so priority should follow the vendor's fixed-release schedule rather than emergency out-of-band action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is Cisco's open-source signature-based intrusion detection and prevention engine, embedded as the inspection core in Cisco Secure Firewall Threat Defense (FTD), the Unified Threat Defense (UTD) Snort IPS engine, and Cisco Cyber Vision, as well as distributed standalone. The CPE data confirms four affected product families: cisco_open_source_snort3, cisco_secure_firewall_threat_defense_(ftd)_software, cisco_utd_snort_ips_engine_software, and cisco_cyber_vision. The root cause class is CWE-400 (Uncontrolled Resource Consumption): specially crafted or high-volume traffic reaching the detection path can drive the engine to allocate or retain resources without adequate bounds, degrading or halting inspection. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack is network-reachable with low complexity and requires no credentials or user interaction, but the preconditions layer in a deployment constraint - the sensor must be actively inspecting packets, so passive/tap-only or out-of-path installations are not exposed to the availability impact. The impact is strictly availability (C:N/I:N/A:H) with scope unchanged.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Inspection engine processes attacker-controlled network traffic without authentication (AV:N/PR:N/UI:N), low complexity, and the only impact is availability (A:H; C:N/I:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.
Executive ViewAI
Cisco's Snort 3 detection engine contains a high-severity denial-of-service vulnerability (CVE-2026-20356) that can be triggered remotely without authentication, potentially exhausting resources on Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS, Cisco Cyber Vision, and open source Snort 3 deployments that inspect attacker-influenced traffic. Organizations relying on these platforms for inline intrusion prevention or network visibility face disruption of inspection services, which could create temporary blind spots and weaken security enforcement. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should prioritize identifying exposed inline deployments and implementing interim mitigations.
No vendor-released patch identified at time of analysis; interim mitigations include restricting management and inspection-plane access, applying network rate limiting, segmenting traffic to limit attacker-influenced flows, monitoring resource utilization, maintaining redundant inspection capacity, and following Cisco advisory guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB