Threat reportVulnerabilityTL-2026-4210
Multiple Vulnerabilities Fixed in Cisco Snort 3 (NCSC-2026-0450; CVE-2026-20043, CVE-2026-76524 and 11 others)
Multiple Vulnerabilities Fixed in Cisco Snort 3 (TL-2026-4210), also tracked as NCSC-2026-0450, is a critical-severity software vulnerability scored CVSS 9, first published 2026-10-23. It has no confirmed attribution, affects Cisco Open Source Snort 3, references 13 CVEs (CVE-2026-20011, CVE-2026-20019, CVE-2026-20043), maps to 3 MITRE ATT&CK techniques (T1059, T1190, T1499.004), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9/10Critical
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4210
- Threat ID
- TL-2026-4210
- Also known as
- NCSC-2026-0450, cisco-sa-hardening-snort3-ybgmhTQe, Snort 3 Security Hardening Release October 2026
- Severity
- CRITICAL
- CVSS
- 9
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, telecoms, energy, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How Multiple Vulnerabilities Fixed in Cisco Snort 3 works
On 2026-10-21 Cisco published seven advisories fixing 13 Snort 3 vulnerabilities found in an internal security review, led by an out-of-bounds write (CVE-2026-20043, CVSS 9.0). Most flaws let an unauthenticated remote attacker crash or restart the Snort 3 Detection Engine, and CVE-2026-76524 lets a low-privileged local user run commands via the control channel socket. Cisco is not aware of public exploits or malicious use.
Cisco's Open Source Snort 3 engineering team ran an internal security review of Snort 3 and issued hardening releases for internally discovered vulnerabilities. Cisco says it used existing testing processes as well as frontier AI models, and press coverage names researcher Michael Bommarito as the reporter of four DoS flaws, reported with assistance from Claude AI. For the hardening advisory (cisco-sa-hardening-snort3-ybgmhTQe) Cisco assigned one CVE per CWE grouping: CVE-2026-20236 (CWE-682 incorrect calculation, CVSS 9.0), CVE-2026-20043 (CWE-787 out-of-bounds write, CVSS 9.0), CVE-2026-20291 (CWE-269 improper privilege management, CVSS 7.8) and CVE-2026-20356 (CWE-400 uncontrolled resource consumption, CVSS 7.5).
Separate advisories cover individual parser and engine components. CVE-2026-20011 (SMTP MIME decoder, CWE-805, CVSS 5.8; AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) is triggered by crafted SMTP packets sent through an established connection, because MIME fields in SMTP headers get insufficient error checking. CVE-2026-20221 (GRE, CWE-476 null pointer dereference, CVSS 5.8) comes from improper handling of nested GRE traffic. It can restart the engine, causing a DoS or a detection bypass depending on configuration. CVE-2026-20179 is another GRE Detection Engine flaw (incomplete error checking when parsing GRE packets, CVSS 5.8). CVE-2026-20019 is reported by third-party trackers as a NetFlow detection flaw (incomplete error checking when parsing UDP NetFlow packets, CVSS 5.8), although one secondary source labels it as GTP-related. CVE-2026-76445 (GTP codec, CWE-835 infinite loop, CVSS 5.3) is triggered by a crafted, fragmented UDP datagram containing GTP extension headers. CVE-2026-20218 (VBA decompression, CVSS 5.8) is caused by improper range checking on user-controlled VBA data, with stack-based buffer overflow classification. The remaining IDs (CVE-2026-20197 in the Snort 3 multiple-DoS advisory, and CVE-2026-76489) could not be fully characterized from retrievable sources.
CVE-2026-76524 (Open Source Snort 3 control channel socket, CWE-306, CVSS 7.8; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is an authentication flaw: an authenticated, local, low-privileged attacker can connect to the control channel socket to execute arbitrary commands as the Snort 3 process user and read and write Snort process memory. It was reported by Pulkit Sanadhya and Yazan Balawneh (CyStack.ps), and CVE-2026-20019 research credit is given to Yazdan Soltani in a secondary source.
Affected: Open Source Snort 3 before 3.12.4.0, Cisco Secure Firewall Threat Defense (FTD), Cisco Cyber Vision, Unified Threat Defense (UTD) on IOS XE, and Meraki MX. Cisco Cloud-delivered Firewall and Secure Access were updated by Cisco on 2026-10-21 and need no customer action. Open Source Snort 2 (end of life) is not affected. No workarounds exist; upgrading is required. Because Snort is an inline inspection engine, repeated crashes can interrupt packet inspection and, depending on fail-open and preserve-connection settings, let traffic pass uninspected. The NCSC-NL advisory (2026-10-22) restates the Cisco disclosures. Cisco and NCSC-NL do not report active exploitation or a public PoC.
MITRE ATT&CK techniques used in TL-2026-4210
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Multiple Vulnerabilities Fixed in Cisco Snort 3
- Cisco — Open Source Snort 3
Vulnerable versions: all releases before 3.12.4.0
Fixed in: 3.12.4.0; 3.10.1.0 (CVE-2026-20011 only) - Cisco — Secure Firewall Threat Defense (FTD) with Snort 3
Vulnerable versions: Snort 3 builds before the fixed releases
Fixed in: 7.2.12; 7.4.8; 7.6.6; 7.7.13; 10.0.2 - Cisco — Cyber Vision
Vulnerable versions: 5.4 and earlier; releases before 5.6.0
Fixed in: 5.5.0 (GRE); 5.6.0 - Cisco — Unified Threat Defense (UTD) on IOS XE
Vulnerable versions: releases with Snort 3 before 3.12.4.0
Fixed in: 17.12.8; 17.15.6; 17.18.5; 26.1.2; 26.2.1 - Cisco — Meraki MX Security Appliances (MX64-MX600)
Vulnerable versions: pre-2026-10-21 firmware
Fixed in: automatic update deployed 2026-10-21 - Cisco — Cloud-delivered Firewall (CDFW) and Secure Access (CSA)
Vulnerable versions: pre-2026-10-21 service
Fixed in: updated by Cisco 2026-10-21
Remediation for Multiple Vulnerabilities Fixed in Cisco Snort 3
Patches
- Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe
- Cisco advisory cisco-sa-opensrc-snort3-2fXGJPfe
- Cisco advisory cisco-sa-snort3-mime-vulns-bkXjcKkt
- Cisco advisory cisco-sa-snort3-gre-JNpMHrTv
- Cisco advisory cisco-sa-snort3-gtpcodec-dos-Rmecfepz
- Meraki MX, Cloud-delivered Firewall and Secure Access were updated automatically on 2026-10-21
Immediate actions
- Upgrade Open Source Snort 3 to 3.12.4.0 or later
- Upgrade Cisco Secure FTD to a fixed release (for CVE-2026-20043: 7.2.12, 7.4.8, 7.6.6, 7.7.13 or 10.0.2, or later in the train)
- Upgrade Cisco Cyber Vision to 5.6.0 or later (GRE fix also in 5.5.0)
- Upgrade IOS XE UTD to 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1 or later
- Restrict local access to the Snort 3 control channel socket on hosts running open-source Snort 3 until patched
Workarounds
- None available per Cisco; software upgrade is required
Longer-term hardening
- Monitor Snort 3 Detection Engine restarts and crashes as a possible exploitation signal
- Review Snort fail-open and preserve-connection settings to understand what traffic is uninspected during an engine restart
- Run Snort 3 under a dedicated low-privilege account to limit the impact of the control channel flaw
CVEs associated with Multiple Vulnerabilities Fixed in Cisco Snort 3
Weaknesses (CWE) in Multiple Vulnerabilities Fixed in Cisco Snort 3
CWE-787, CWE-682, CWE-269, CWE-400, CWE-306, CWE-805, CWE-476, CWE-835
Timeline of Multiple Vulnerabilities Fixed in Cisco Snort 3
- Context: Cisco discloses earlier Snort 3 DCE/RPC vulnerabilities (CVE-2026-20026, CVE-2026-20027) affecting FTD, open-source Snort 3, IOS XE UTD and Meraki, fixed in Snort 3.9.6.0
- Cisco publishes CVE-2026-76524 (control channel socket command execution, CVSS 7.8), credited to Pulkit Sanadhya and Yazan Balawneh (CyStack.ps); no workaround
- Open Source Snort 3 3.12.4.0 and fixed FTD, Cyber Vision and IOS XE UTD releases become available; Meraki MX, Cloud-delivered Firewall and Secure Access are updated automatically by Cisco
- Cisco publishes seven advisories fixing 13 Snort 3 vulnerabilities found during internal testing, including the Snort 3 hardening advisory (CVE-2026-20043, CVSS 9.0)
- NCSC-NL publishes NCSC-2026-0450 summarizing the Snort 3 fixes; no active exploitation or public PoC stated
- Cisco updates the hardening, MIME, GRE and GTP advisories to version 1.1 (Final)
Sources cited for Multiple Vulnerabilities Fixed in Cisco Snort 3
- NCSC-NL Advisory NCSC-2026-0450: Kwetsbaarheden verholpen in Snort 3 van Cisco
- Cisco Security Advisory: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
- Cisco Security Advisory: Open Source Snort 3 Control Channel Socket Arbitrary Command Execution (CVE-2026-76524)
- Cisco Security Advisory: Snort 3 SMTP MIME Decoder Vulnerabilities (CVE-2026-20011)
- Cisco Security Advisory: Snort 3 GRE Denial of Service (CVE-2026-20221)
- Cisco Security Advisory: Snort 3 GTP Codec Denial of Service (CVE-2026-76445)
- Cisco Fixes 13 Snort 3 Vulnerabilities, Including CVSS 9.0 Out-of-Bounds Write
- CVE-2026-20218 Cisco Snort VBA Decompression stack-based overflow
- CVE-2026-20179 Cisco Open Source Snort3 GRE Detection input validation
- Cisco October 2026 Updates: Expressway, Snort and UC Fixes
- Cisco Snort 3 Security Flaws Threaten Network Inspection (earlier Snort 3 DCE/RPC flaws, context)
Detection coverage for TL-2026-4210
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4210 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.