Cisco Snort 3: critical flaws (CVE-2026-20043, CVE-2026-20236) fixed in 3.12.4.0 and Cisco product releases
CVE-2026-20019 CVE-2026-20043 CVE-2026-20179 CVE-2026-20197 CVE-2026-20236 CVE-2026-20291 CVE-2026-20356 CVE-2026-76489 CVE-2026-76524
Published 05/11/2026 02:49
Timeline
2 events over 14 d
- 21/10/2026 18:09ConfirmedCisco Security Advisories+14 d
- 05/11/2026 02:49Published on WatchtowerPro CISO
In short
Cisco has released hardening updates for Snort 3, the intrusion detection engine used in several Cisco products, fixing multiple flaws. Two are rated Critical (CVSS 9.0), and others allow a crash of traffic inspection or command execution by a local user. Cisco and NCSC-NL confirm the flaws; no attacks are known. Update to the fixed versions.
How bad is it
Critical. Depending on the flaw, an attacker may crash or interrupt traffic inspection (some without logging in), or a local user with a low-privilege account can run commands on a Snort 3 host.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 9 CVEs · CVSS 3.1 from NVD, from cisco.com, read 05/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: memory corruption.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Regardless of device configuration, per Cisco's hardening advisory: Cisco Cloud-delivered Firewall (CDFW), Cyber Vision, Meraki MX, Secure Access (CSA), Secure Firewall Threat Defense (FTD), Open Source Snort 3 and Unified Threat Defense (UTD) on Cisco IOS XE.
- CVE-2026-76524 (control channel socket) names only Open Source Snort 3; a local low-privilege user can run commands as the Snort 3 process user.
- Snort 2 is not affected according to Cisco.
- IOS XE: UTD is not installed by default; without the UTD package the device is not affected.
Fixed in
- 3 branch: 3.12.4.0
- 7.0 branch: 7.0.10
- 7.2 branch: 7.2.12
- 7.4 branch: 7.4.8
- 7.6 branch: 7.6.6
- 7.7 branch: 7.7.13
- 10.0 branch: 10.0.2
- 10.1 branch: 10.1.0
What to do now
- Update to the fixed versions: Open Source Snort 3 3.12.4.0; FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0; IOS XE UTD 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1 (Snort 3.12.4.0 images); Cyber Vision 5.6.0.
- Find FTD devices running Snort 3 and IOS XE devices with UTD running (check with: show utd engine standard status; 'Yes' under Running means UTD is enabled).
- Cisco lists no workaround for these flaws, so interim measures only reduce exposure and do not make a device safe. For open-source Snort 3, restrict who can log in locally to the sensor host until updated.
- Cyber Vision earlier than 5.6: migrate to a fixed release.
- For FTD branches not in Cisco's table, check fixed releases with the Cisco Software Checker.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run Cisco Snort 3 and multiple Cisco products (advance notice), at which version, fixed or not - and what each one needs.
Main sources
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories Vendor · Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 Vendor · NCSC-2026-0450 [1.00] [M/H] Kwetsbaarheden verholpen in Snort 3 van Cisco CERT