Multiple Cisco Products Snort 3 security hardening release addresses critical out-of-bounds write (CVE-2026-20043)

What happened

Cisco's Snort 3 engineering team conducted an internal security review and released software hardening updates to address multiple internally discovered vulnerabilities. The critical issue, CVE-2026-20043, is an out-of-bounds write (CWE-787). Cisco's CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with a score of 9. An unauthenticated attacker could reach it over the network without user interaction, but Cisco notes high attack complexity. Successful exploitation could affect confidentiality, integrity and availability, with scope changed.

CVE-2026-20291 is a local improper privilege management flaw (CWE-269). Cisco's vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a score of 7.8. A local attacker with low privileges would need no user interaction and could gain high impact across confidentiality, integrity and availability.

CVE-2026-20236 (CWE-682, score 7.5) and CVE-2026-20356 (CWE-400, score 7.5) are both network-reachable with no privileges and no user interaction. Cisco's vectors show scope unchanged, no confidentiality or integrity impact, and high availability impact, meaning an unauthenticated attacker could cause denial of service.

Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.

Who is affected

Affected products and releases are:

• Cisco Cyber Vision 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1 and 3.1.2.
• Cisco Open Source Snort3 3.12.2.0, 3.1.2.0, 3.1.3.0, 3.1.4.0, 3.1.5.0, 3.1.6.0, 3.1.7.0 and 3.1.8.0.
• Cisco Secure Firewall Threat Defense (FTD) Software 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3, 7.2.0 and 7.2.0.1.
• Cisco UTD SNORT IPS Engine Software 17.3.1a, 17.3.2, 17.3.3, 17.3.4, 17.3.4a, 17.4.1a, 17.5.1, 17.5.1a, 17.12.1a, 17.12.2, 17.12.3, 17.12.3a, 17.12.4, 17.13.1a, 17.14.1a and 17.15.1a.

The affected version sets differ between the CVEs; this is the combined list. These products sit in network inspection and threat detection paths.

What to do now

1. Open Cisco's advisory and identify the hardening release for your product and current version. Cisco has released fixes, but this page does not include a fixed-version list; the Cisco advisory is the authoritative mapping.
2. Apply the hardening release as soon as possible. There are no workarounds that address these vulnerabilities.
3. Until patching is complete, restrict management and inspection interfaces to trusted networks.
4. Prioritise devices that inspect untrusted traffic, including Secure Firewall Threat Defense, UTD SNORT IPS Engine, Cyber Vision and Open Source Snort3 deployments.

Beyond the patch

Because the critical flaw is network-reachable without credentials, it belongs in exposure management: Virtual CISO Services (vCISO) can help identify where Snort 3-based inspection devices are reachable and prioritise them before they are targeted. This advisory also illustrates why tracking the software you run and how quickly Cisco moves is a Supply Chain Defense & Third-Party Risk task. Apply the update first, then make sure your process can find these components next time.