# CVE-2026-20011: Cisco multiple products SMTP MIME parsing denial of service in Snort 3

Source: https://junglewise.ai/threats/cve-2026-20011-multiple-cisco-products-are-affected-by-a-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-20011 · Severity: medium · CVSS 5.8 · Published 2026-10-21

Cisco Snort 3, a network intrusion detection engine used in multiple security products, contains a flaw in how it parses SMTP email headers that could allow a remote attacker to crash the detection engine. An attacker can send specially crafted email packets to cause the engine to restart unexpectedly, disrupting network monitoring and threat detection capabilities.

Technologies: [Cisco IOS XE Unified Threat Defense](https://junglewise.ai/threats/technologies/ios-xe-unified-threat-defense), [Cisco Meraki MX Security Appliances](https://junglewise.ai/threats/technologies/meraki-mx-security-appliances), [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20011 being exploited in the wild.

**How severe is CVE-2026-20011?** Medium severity, with a CVSS score of 5.8, published 21 October 2026.

**Which products and versions are affected?** Cisco Snort 3; Cisco Secure Firewall Threat Defense; Cisco IOS XE Unified Threat Defense; Cisco Meraki MX Security Appliances.

**Is there a fix for CVE-2026-20011?** No fixed version is recorded yet. No workarounds are available; software updates must be applied to address this vulnerability.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20011 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20011?** Check whether you run Cisco IOS XE Unified Threat Defense, Cisco Meraki MX Security Appliances, Cisco Secure Firewall Threat Defense or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


No workarounds are available; software updates must be applied to address this vulnerability.</anigation>
</invoke>

## Technical details

The vulnerability exists in the Snort 3 SMTP MIME Decoder due to insufficient error checking when parsing MIME fields in SMTP headers (CWE-805). An unauthenticated remote attacker can send crafted SMTP packets over an established connection that will be parsed by Snort 3, triggering an unhandled condition that causes the Detection Engine to restart, resulting in a denial of service condition.

## Affected products

- Cisco Snort 3
- Cisco Secure Firewall Threat Defense
- Cisco IOS XE Unified Threat Defense
- Cisco Meraki MX Security Appliances

## Timeline

- 2026-10-21: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)