ZDI-26-046
CRITICAL 9.8
Published
Jan 28, 2026
Cisco Snort _bnfa_search_csparse_nfa Use-After-Free Remote Code Execution Vulnerability
Cisco
Cisco Snort contains a critical remote code execution vulnerability (CVE-2026-20026, CVSS 9.8) that allows unauthenticated attackers to execute arbitrary code on vulnerable installations. An attacker can exploit this without any credentials or special access, making it extremely dangerous for any organization running affected Snort deployments. Security teams should immediately prioritize patching Cisco Snort systems and consider temporarily isolating or restricting access to vulnerable instances until updates are available.