# CVE-2026-20019: Cisco Snort 3 NetFlow Detection Engine denial of service

Source: https://junglewise.ai/threats/cve-2026-20019-multiple-cisco-products-are-affected-by-a-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-20019 · Severity: medium · CVSS 5.8 · Published 2026-10-21

Multiple Cisco products embed Snort 3, an intrusion detection engine that inspects network packets for threats. A flaw in how Snort 3 handles malformed NetFlow protocol packets allows an unauthenticated attacker to send a single crafted packet that crashes the detection engine, causing a temporary outage of threat protection until the engine restarts.

Technologies: [Cisco Cloud Services Router 1000V](https://junglewise.ai/threats/technologies/cloud-services-router-1000v), [Cisco IOS XE Unified Threat Defense](https://junglewise.ai/threats/technologies/ios-xe-unified-threat-defense), [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20019 being exploited in the wild.

**How severe is CVE-2026-20019?** Medium severity, with a CVSS score of 5.8, published 21 October 2026.

**Which products and versions are affected?** Cisco Snort 3; Cisco Secure Firewall Threat Defense; Cisco IOS XE Unified Threat Defense; Cisco Meraki MX64; and 29 more.

**Is there a fix for CVE-2026-20019?** No fixed version is recorded yet. No workarounds are available; upgrading to patched software is the only remediation. For Cisco Secure FTD Software, verify that Snort 3 is active (new installations of Release 7.0.0 and later run Snort 3 by default). For IOS XE products, confirm that Unified Threat Defense is enabled using the show utd engine standard status command before applying updates. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20019 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20019?** Check whether you run Cisco Catalyst 8000V, Cisco Catalyst 8100, Cisco Catalyst 8200 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


No workarounds are available; upgrading to patched software is the only remediation. For Cisco Secure FTD Software, verify that Snort 3 is active (new installations of Release 7.0.0 and later run Snort 3 by default). For IOS XE products, confirm that Unified Threat Defense is enabled using the show utd engine standard status command before applying updates.

## Technical details

The vulnerability stems from incomplete error checking in Snort 3's UDP NetFlow Protocol packet parser (CWE-119, CWE-128, CWE-401). An unauthenticated remote attacker can send a single crafted NetFlow packet over the network to trigger a denial of service, causing the Snort 3 Detection Engine to restart unexpectedly. No authentication or user interaction is required; Snort 3 must be configured to parse NetFlow connections to be exploited.

## Affected products

- Cisco Snort 3
- Cisco Secure Firewall Threat Defense
- Cisco IOS XE Unified Threat Defense
- Cisco Meraki MX64
- Cisco Meraki MX64W
- Cisco Meraki MX65
- Cisco Meraki MX65W
- Cisco Meraki MX67
- Cisco Meraki MX67C
- Cisco Meraki MX67W
- Cisco Meraki MX68
- Cisco Meraki MX68CW
- Cisco Meraki MX75
- Cisco Meraki MX84
- Cisco Meraki MX85
- Cisco Meraki MX95
- Cisco Meraki MX100
- Cisco Meraki MX105
- Cisco Meraki MX250
- Cisco Meraki MX400
- Cisco Meraki MX450
- Cisco Meraki MX600
- Cisco ISR 1000
- Cisco ISR 4000
- Cisco Catalyst 8000V
- Cisco Catalyst 8100
- Cisco Catalyst 8200
- Cisco Catalyst 8300
- Cisco Catalyst 8400
- Cisco Catalyst 8500L
- Cisco Catalyst IR1800
- Cisco Catalyst IR8340
- Cisco Cloud Services Router 1000V

## Timeline

- 2026-10-21: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)