Cisco Snort 3 October 2026 security hardening release fixes critical out-of-bounds write and three high-severity flaws

What happened

Cisco has published an October 2026 security hardening release for the Snort 3 engine after an internal security review. The release addresses four vulnerabilities across products that embed Snort 3.

CVE-2026-20043 is the most severe, rated 9.0 Critical. It is an out-of-bounds write reachable over the network with no credentials or user interaction, though Cisco's scoring assumes high attack complexity. Successful exploitation could corrupt memory and affect confidentiality, integrity and availability within the affected system.

CVE-2026-20291 is a local improper privilege management flaw rated 7.8 High; a local attacker with low privileges could gain broad control. CVE-2026-20236, caused by incorrect calculation, and CVE-2026-20356, caused by uncontrolled resource consumption, are both rated 7.5 High and can be triggered remotely without credentials to exhaust or disrupt the engine, causing a denial of service.

Cisco PSIRT states it is not aware of any public announcements or malicious use of the vulnerabilities described in the advisory.

Who is affected

Cisco lists four affected product families. The affected version lists vary by CVE; the full matrix is in Cisco's advisory. The versions named in the advisory include:

• Cisco Cyber Vision: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1 and 3.1.2
• Cisco Open Source Snort 3: 3.1.2.0, 3.1.3.0, 3.1.4.0, 3.1.5.0, 3.1.6.0, 3.1.7.0, 3.1.8.0 and 3.12.2.0
• Cisco Secure Firewall Threat Defense (FTD) Software: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3, with 7.2.0 and 7.2.0.1 also named in some CVE lists
• Cisco UTD SNORT IPS Engine Software: 17.3.1a, 17.3.2, 17.3.3, 17.3.4, 17.3.4a, 17.4.1a, 17.5.1, 17.5.1a, 17.12.1a, 17.12.2, 17.12.3, 17.12.3a, 17.12.4, 17.13.1a, 17.14.1a and 17.15.1a

What to do now

1. Confirm whether you run any affected Cisco Cyber Vision, Open Source Snort 3, Secure Firewall Threat Defense or UTD SNORT IPS Engine Software, and compare your installed version with the lists in Cisco's advisory.
2. Apply the Cisco Snort 3 October 2026 security hardening release as a priority, starting with internet-facing or otherwise network-reachable instances.
3. There are no workarounds that address these vulnerabilities. If you cannot patch immediately, restrict access to affected engines to trusted networks and monitor for signs of instability.
4. For Firewall Threat Defense and UTD SNORT IPS in particular, follow Cisco's upgrade path for your hardware and software combination; these engines are embedded components rather than standalone packages.

How to detect it

Cisco has not published specific indicators of compromise for these vulnerabilities. Because two of the flaws can cause denial of service through incorrect calculation or uncontrolled resource consumption, unexpected restarts or resource exhaustion in a network-reachable Snort 3 engine are worth investigating. This is not vendor-provided detection guidance.

Beyond the patch

These flaws sit inside a shared engine embedded across multiple Cisco product lines, so the practical exposure depends on knowing where Snort 3 is running and whether those instances are reachable. Our Virtual CISO Services (vCISO) can help map external exposure and prioritise patching, while Supply Chain Defense & Third-Party Risk helps track component dependencies and the vendor patch cycles that set your exposure window.