Quick answers
- Is CVE-2026-20011 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20011 being exploited in the wild.
- How severe is CVE-2026-20011?
- Medium severity, with a CVSS score of 5.8, published 21 October 2026.
- Which products and versions are affected?
- Cisco Snort 3; Cisco Secure Firewall Threat Defense; Cisco IOS XE Unified Threat Defense; Cisco Meraki MX Security Appliances.
- Is there a fix for CVE-2026-20011?
- No fixed version is recorded yet. No workarounds are available; software updates must be applied to address this vulnerability.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-20011 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-20011?
- Check whether you run Cisco IOS XE Unified Threat Defense, Cisco Meraki MX Security Appliances, Cisco Secure Firewall Threat Defense or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
No workarounds are available; software updates must be applied to address this vulnerability.</anigation> </invoke>
Technical details
The vulnerability exists in the Snort 3 SMTP MIME Decoder due to insufficient error checking when parsing MIME fields in SMTP headers (CWE-805). An unauthenticated remote attacker can send crafted SMTP packets over an established connection that will be parsed by Snort 3, triggering an unhandled condition that causes the Detection Engine to restart, resulting in a denial of service condition.
Affected products
- Cisco Snort 3
- Cisco Secure Firewall Threat Defense
- Cisco IOS XE Unified Threat Defense
- Cisco Meraki MX Security Appliances
Timeline
- 2026-10-21: disclosed