EUVD-2026-81150
GHSA-xxfc-5fpg-3fhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FTD inspecting SSL/TLS
-
DeliverySend crafted SSL connection setup
-
ExploitMalformed certificate parsed by Snort 2
-
ExecutionIncomplete validation triggers fault
-
ImpactDetection engine restarts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer access bounds checking
|
| Exploitation Conditions | The affected device must be a Cisco Secure Firewall Threat Defense (FTD) instance running the legacy Snort 2 Detection Engine (not Snort 3) and processing SSL/TLS traffic such that certificate parsing occurs - i.e., handling SSL connection setup / SSL policy inspection. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required and the crafted SSL connection can be delivered remotely. Limiting factors: the engine-version dependency (Snort 2 specifically) and the requirement that the device inspect the SSL handshake path; impact is bounded to a temporary engine restart (A:L), not persistent outage or code execution. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and only LOW availability impact - a transient DoS. The S:C (scope change) reflects that a flaw in the Snort 2 inspection engine affects traffic-forwarding beyond the vulnerable component itself. This is NOT a high-priority emergency: the impact is a single-engine restart (a temporary inspection/forwarding disruption), not code execution or full device reload, and A is only Low. No EPSS score, KEV listing, or POC is provided, so exploitation probability signals are absent rather than high. The one aggravating factor is the low bar to attempt: no auth, no user interaction, and the trigger is a crafted SSL/TLS connection setup that the engine will parse in the normal course of inspecting traffic. Realistic priority is MODERATE - patch on a normal cadence; it is not a drop-everything item. No signals conflict; the main missing data are EPSS and any exploitation telemetry. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted SSL/TLS connection setup request (malformed certificate) through or to an FTD device configured to inspect SSL traffic with the Snort 2 engine. Incomplete certificate validation causes the Snort 2 Detection Engine to restart, briefly disrupting traffic inspection/forwarding. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
RemediationAI
Cisco has published a security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c and the input does not provide a specific fixed FTD version; patch status is therefore 'Patch available per vendor advisory' and administrators should consult that advisory for the exact fixed releases and upgrade instructions. Until the applicable FTD upgrade can be applied, reduce exposure by determining whether the device is running Snort 2 and, if supported for the required features, migrating to Snort 3-recognizing that Snort 3 rule and feature parity must be validated. If SSL/TLS inspection by Snort 2 cannot be avoided, limit inspection to trusted ingress paths where feasible, but note that this reduces visibility and may not fully eliminate the attack surface because the vulnerable parser is reached through SSL connection setup. No public exploit code has been identified at time of analysis, so emergency workarounds are not indicated by exploit activity; prioritize normal advisory-driven patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-805 (Buffer Access with Incorrect Length Value), caused by incomplete validation of an SSL certificate as it is parsed by the Snort 2 Detection Engine in Cisco FTD. Snort 2 is the legacy intrusion detection/prevention engine; FTD devices configured with Snort 2 and SSL/TLS inspection inspect the TLS handshake and certificate exchange, so a malformed certificate or SSL connection setup request can reach the vulnerable parser. The CPE cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software:*:*:*:*:*:*:*:* identifies Cisco FTD Software broadly, and the EUVD advisory enumerates many affected builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, and 7.6.x trains. Because only availability is impacted (A:L) and no privilege or user interaction is required (PR:N/UI:N), the practical result is a temporary engine restart, not persistent compromise.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Unauthenticated remote crafted SSL packet (AV:N/AC:L/PR:N/UI:N); flaw in inspection engine disrupts forwarded traffic (S:C); only transient engine restart, so A:L and C:N/I:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.
This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB