# Multiple Vulnerabilities Fixed in Cisco Snort 3 (NCSC-2026-0450; CVE-2026-20043, CVE-2026-76524 and 11 others)

> On 2026-10-21 Cisco published seven advisories fixing 13 Snort 3 vulnerabilities found in an internal security review, led by an out-of-bounds write (CVE-2026-20043, CVSS 9.0). Most flaws let an unauthenticated remote attacker crash or restart the Snort 3 Detection Engine, and CVE-2026-76524 lets a low-privileged local user run commands via the control channel socket. Cisco is not aware of public exploits or malicious use.

- **Published:** 2026-10-23T03:07:05Z
- **Last reviewed:** 2026-10-23T03:07:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4210
- **ID:** TL-2026-4210
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20011, CVE-2026-20019, CVE-2026-20043, CVE-2026-20179, CVE-2026-20197, CVE-2026-20218, CVE-2026-20221, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76445, CVE-2026-76489, CVE-2026-76524

## Description

Cisco's Open Source Snort 3 engineering team ran an internal security review of Snort 3 and issued hardening releases for internally discovered vulnerabilities. Cisco says it used existing testing processes as well as frontier AI models, and press coverage names researcher Michael Bommarito as the reporter of four DoS flaws, reported with assistance from Claude AI. For the hardening advisory (cisco-sa-hardening-snort3-ybgmhTQe) Cisco assigned one CVE per CWE grouping: CVE-2026-20236 (CWE-682 incorrect calculation, CVSS 9.0), CVE-2026-20043 (CWE-787 out-of-bounds write, CVSS 9.0), CVE-2026-20291 (CWE-269 improper privilege management, CVSS 7.8) and CVE-2026-20356 (CWE-400 uncontrolled resource consumption, CVSS 7.5).

Separate advisories cover individual parser and engine components. CVE-2026-20011 (SMTP MIME decoder, CWE-805, CVSS 5.8; AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) is triggered by crafted SMTP packets sent through an established connection, because MIME fields in SMTP headers get insufficient error checking. CVE-2026-20221 (GRE, CWE-476 null pointer dereference, CVSS 5.8) comes from improper handling of nested GRE traffic. It can restart the engine, causing a DoS or a detection bypass depending on configuration. CVE-2026-20179 is another GRE Detection Engine flaw (incomplete error checking when parsing GRE packets, CVSS 5.8). CVE-2026-20019 is reported by third-party trackers as a NetFlow detection flaw (incomplete error checking when parsing UDP NetFlow packets, CVSS 5.8), although one secondary source labels it as GTP-related. CVE-2026-76445 (GTP codec, CWE-835 infinite loop, CVSS 5.3) is triggered by a crafted, fragmented UDP datagram containing GTP extension headers. CVE-2026-20218 (VBA decompression, CVSS 5.8) is caused by improper range checking on user-controlled VBA data, with stack-based buffer overflow classification. The remaining IDs (CVE-2026-20197 in the Snort 3 multiple-DoS advisory, and CVE-2026-76489) could not be fully characterized from retrievable sources.

CVE-2026-76524 (Open Source Snort 3 control channel socket, CWE-306, CVSS 7.8; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is an authentication flaw: an authenticated, local, low-privileged attacker can connect to the control channel socket to execute arbitrary commands as the Snort 3 process user and read and write Snort process memory. It was reported by Pulkit Sanadhya and Yazan Balawneh (CyStack.ps), and CVE-2026-20019 research credit is given to Yazdan Soltani in a secondary source.

Affected: Open Source Snort 3 before 3.12.4.0, Cisco Secure Firewall Threat Defense (FTD), Cisco Cyber Vision, Unified Threat Defense (UTD) on IOS XE, and Meraki MX. Cisco Cloud-delivered Firewall and Secure Access were updated by Cisco on 2026-10-21 and need no customer action. Open Source Snort 2 (end of life) is not affected. No workarounds exist; upgrading is required. Because Snort is an inline inspection engine, repeated crashes can interrupt packet inspection and, depending on fail-open and preserve-connection settings, let traffic pass uninspected. The NCSC-NL advisory (2026-10-22) restates the Cisco disclosures. Cisco and NCSC-NL do not report active exploitation or a public PoC.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation

## Sources

- [NCSC-NL Advisory NCSC-2026-0450: Kwetsbaarheden verholpen in Snort 3 van Cisco](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0450)
- [Cisco Security Advisory: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe)
- [Cisco Security Advisory: Open Source Snort 3 Control Channel Socket Arbitrary Command Execution (CVE-2026-76524)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe)
- [Cisco Security Advisory: Snort 3 SMTP MIME Decoder Vulnerabilities (CVE-2026-20011)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt)
- [Cisco Security Advisory: Snort 3 GRE Denial of Service (CVE-2026-20221)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv)
- [Cisco Security Advisory: Snort 3 GTP Codec Denial of Service (CVE-2026-76445)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz)
- [Cisco Fixes 13 Snort 3 Vulnerabilities, Including CVSS 9.0 Out-of-Bounds Write](https://securityonline.info/cisco-snort-3-vulnerabilities-october-2026/)
- [CVE-2026-20218 Cisco Snort VBA Decompression stack-based overflow](https://vuldb.com/vuln/424887)
- [CVE-2026-20179 Cisco Open Source Snort3 GRE Detection input validation](https://vuldb.com/vuln/424885)
- [Cisco October 2026 Updates: Expressway, Snort and UC Fixes](https://www.penligent.ai/hackinglabs/cisco-october-2026-security-updates/)
- [Cisco Snort 3 Security Flaws Threaten Network Inspection (earlier Snort 3 DCE/RPC flaws, context)](https://www.esecurityplanet.com/threats/cisco-snort-3-security-flaws-threaten-network-inspection/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4210