Cisco Snort 3 hardening update fixes critical CVE-2026-20043
At a glance
| Severity | CRITICAL |
|---|---|
| CVSS | CVE-2026-20043: 9.0 |
| EPSS (30-day exploit probability) | CVE-2026-20043: 0.3% |
| In CISA KEV (exploited) | No |
| Vendor | Cisco |
| CVE IDs | CVE-2026-20043 |
Cisco has published a critical advisory for a Snort 3 security hardening release that affects several of its products, including Secure Firewall Threat Defense (FTD) and Meraki MX appliances. The Snort 3 vulnerability, tracked as CVE-2026-20043, is an out-of-bounds write rated CVSS 9.0, and Cisco says it is not known to be actively exploited. No workarounds exist, so the fix is to install the updated software, as described in the Cisco Security Advisory.
What happened
Cisco’s own Snort 3 engineering team ran an internal security review and found multiple vulnerabilities. Cisco released hardening updates to address them. These issues were found during internal testing, and Cisco states they are not known to be actively exploited.
To make patching simpler, Cisco grouped the issues by weakness class (CWE) and assigned one CVE ID to each group. CVE-2026-20043 covers the out-of-bounds write group (CWE-787). The advisory also lists CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356, and the weakness classes CWE-269, CWE-400, CWE-682 and CWE-787. Cisco notes it may publish separate advisories with details of individual vulnerabilities.
The advisory ID is cisco-sa-hardening-snort3-ybgmhTQe. It was first published on 21 October 2026 and last updated on 22 October 2026 (version 1.1, final).
Am I affected?
Cisco says these vulnerabilities affect the following products regardless of device configuration:
- Cisco Cloud-delivered Firewall (CDFW)
- Cisco Cyber Vision
- Cisco Meraki MX Security Appliances
- Cisco Secure Access (CSA)
- Cisco Secure Firewall Threat Defense (FTD) Software
- Open Source Snort 3
- Unified Threat Defense (UTD) on Cisco IOS XE Software
Which software releases are vulnerable and which contain the fix is listed in the Fixed Software section of the Cisco advisory. NVD does not list affected version ranges for CVE-2026-20043 at the time of writing, so use the Cisco advisory as the source of truth. Because the advisory says the flaws apply regardless of configuration, you cannot rule a device out by checking which features are enabled.
Technical details
- Weakness: out-of-bounds write (CWE-787), meaning software writes data outside the memory it should use, which can corrupt memory.
- CVSS: base score 9.0, critical. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
- Reading the vector: it is network reachable, needs no privileges or user interaction, has high attack complexity, and has a changed scope with high impact on confidentiality, integrity and availability.
- Exploitation: not known to be actively exploited, according to Cisco. The CVE is not in CISA’s Known Exploited Vulnerabilities catalog.
- EPSS: 0.00264, which is a low predicted likelihood of exploitation in the near term.
- Workarounds: none.
The advisory text does not describe the exact trigger or the attacker position in detail. Those details are not disclosed here, so we do not guess at them.
Why this matters
This section is our analysis, not new facts from the advisory.
Snort 3 sits inside inspection engines that handle traffic at the network edge, so a memory-safety flaw there is worth attention even when the attack complexity is high. A low EPSS score and no known exploitation point to a scheduled patch rather than an emergency one. That could change quickly if a public proof of concept appears, so do not leave edge firewalls on old software for long.
For most environments, the practical priority is Secure Firewall Threat Defense and Meraki MX devices facing the internet, followed by IOS XE devices running UTD, and then internal sensors and Cyber Vision deployments.
Detection and hunting ideas
- Watch for unexpected restarts or crashes of the Snort process on affected devices, since memory corruption often shows up as instability first.
- Review firewall and intrusion logs for unusual or malformed traffic bursts before any device crash.
- Alert on unplanned configuration changes or new administrative sessions on firewalls.
What to do
- Make a list of the affected Cisco products in your estate, including open source Snort 3 sensors and UTD on IOS XE.
- Check each against the Fixed Software section of the Cisco advisory and plan the upgrade. Cisco has released software updates for these vulnerabilities.
- Do not rely on a workaround. Cisco states none address these vulnerabilities.
- Patch internet-facing firewalls first, then the rest.
- Subscribe to Cisco’s advisories, because separate advisories with more detail on individual vulnerabilities may follow.
- Record the patch status for audit and tell your network and security operations teams.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
