CVE-2026-20043: Cisco Snort 3 out-of-bounds write

CVE-2026-20043 · Severity: critical · CVSS 9 · Published 2026-10-21

Snort 3 is an open-source intrusion detection and prevention system used to inspect network traffic for threats. This vulnerability allows an attacker to write data outside allocated memory bounds, potentially leading to code execution, data corruption, or system crash. The issue was discovered during Cisco's internal security review and is not known to be exploited in the wild.

Technologies: Cisco Cloud-delivered Firewall, Cisco Cyber Vision, Cisco IOS XE, Cisco Meraki MX Security Appliances, Cisco Secure Access, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20043 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20043 being exploited in the wild.
How severe is CVE-2026-20043?
Critical severity, with a CVSS score of 9, published 21 October 2026.
Which products and versions are affected?
Cisco Cloud-delivered Firewall affected; automatically patched as of 2026-10-21; Cisco Cyber Vision before 5.6.0; Cisco IOS XE with Unified Threat Defense; Cisco Meraki MX Security Appliances with integrated Snort 3; and 3 more.
Is there a fix for CVE-2026-20043?
Yes: fixed in Snort 3 3.12.4.0; Cyber Vision 5.6.0; Cisco CDFW and Secure Access automatically updated 2026-10-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20043 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-20043?
Check whether you run Cisco Cloud-delivered Firewall, Cisco Cyber Vision, Cisco IOS XE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Snort 3 3.12.4.0; Cyber Vision 5.6.0; Cisco CDFW and Secure Access automatically updated 2026-10-21

Technical details

CVE-2026-20043 addresses out-of-bounds write vulnerabilities (CWE-787) in Snort 3 discovered through internal security hardening review. The vulnerability requires network access but has high complexity (CVSS AV:N/AC:H), affecting the confidentiality, integrity, and availability of systems running Snort 3. A fix is available in Snort 3.12.4.0 and later versions.

Affected products

  • Cisco Snort 3 3.x before 3.12.4.0
  • Cisco Cyber Vision before 5.6.0
  • Cisco Cloud-delivered Firewall affected; automatically patched as of 2026-10-21
  • Cisco Secure Access affected; automatically patched as of 2026-10-21
  • Cisco Secure Firewall Threat Defense with integrated Snort 3
  • Cisco Meraki MX Security Appliances with integrated Snort 3
  • Cisco IOS XE with Unified Threat Defense

Timeline

  • 2026-10-21: disclosed: CVE-2026-20043 published by Cisco

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.