CVE-2026-20019: Cisco Snort 3 NetFlow Detection Engine denial of service

CVE-2026-20019 · Severity: medium · CVSS 5.8 · Published 2026-10-21

Multiple Cisco products embed Snort 3, an intrusion detection engine that inspects network packets for threats. A flaw in how Snort 3 handles malformed NetFlow protocol packets allows an unauthenticated attacker to send a single crafted packet that crashes the detection engine, causing a temporary outage of threat protection until the engine restarts.

Technologies: Cisco Cloud Services Router 1000V, Cisco IOS XE Unified Threat Defense, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20019 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20019 being exploited in the wild.
How severe is CVE-2026-20019?
Medium severity, with a CVSS score of 5.8, published 21 October 2026.
Which products and versions are affected?
Cisco Snort 3; Cisco Secure Firewall Threat Defense; Cisco IOS XE Unified Threat Defense; Cisco Meraki MX64; and 29 more.
Is there a fix for CVE-2026-20019?
No fixed version is recorded yet. No workarounds are available; upgrading to patched software is the only remediation. For Cisco Secure FTD Software, verify that Snort 3 is active (new installations of Release 7.0.0 and later run Snort 3 by default). For IOS XE products, confirm that Unified Threat Defense is enabled using the show utd engine standard status command before applying updates. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20019 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20019?
Check whether you run Cisco Catalyst 8000V, Cisco Catalyst 8100, Cisco Catalyst 8200 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

No workarounds are available; upgrading to patched software is the only remediation. For Cisco Secure FTD Software, verify that Snort 3 is active (new installations of Release 7.0.0 and later run Snort 3 by default). For IOS XE products, confirm that Unified Threat Defense is enabled using the show utd engine standard status command before applying updates.

Technical details

The vulnerability stems from incomplete error checking in Snort 3's UDP NetFlow Protocol packet parser (CWE-119, CWE-128, CWE-401). An unauthenticated remote attacker can send a single crafted NetFlow packet over the network to trigger a denial of service, causing the Snort 3 Detection Engine to restart unexpectedly. No authentication or user interaction is required; Snort 3 must be configured to parse NetFlow connections to be exploited.

Affected products

  • Cisco Snort 3
  • Cisco Secure Firewall Threat Defense
  • Cisco IOS XE Unified Threat Defense
  • Cisco Meraki MX64
  • Cisco Meraki MX64W
  • Cisco Meraki MX65
  • Cisco Meraki MX65W
  • Cisco Meraki MX67
  • Cisco Meraki MX67C
  • Cisco Meraki MX67W
  • Cisco Meraki MX68
  • Cisco Meraki MX68CW
  • Cisco Meraki MX75
  • Cisco Meraki MX84
  • Cisco Meraki MX85
  • Cisco Meraki MX95
  • Cisco Meraki MX100
  • Cisco Meraki MX105
  • Cisco Meraki MX250
  • Cisco Meraki MX400
  • Cisco Meraki MX450
  • Cisco Meraki MX600
  • Cisco ISR 1000
  • Cisco ISR 4000
  • Cisco Catalyst 8000V
  • Cisco Catalyst 8100
  • Cisco Catalyst 8200
  • Cisco Catalyst 8300
  • Cisco Catalyst 8400
  • Cisco Catalyst 8500L
  • Cisco Catalyst IR1800
  • Cisco Catalyst IR8340
  • Cisco Cloud Services Router 1000V

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.