# CVE-2026-20052: Cisco Secure Firewall Threat Defense Snort 3 memory management denial of service

Source: https://junglewise.ai/threats/cve-2026-20052-cisco-secure-firewall-threat-defense-snort-3-memory-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20052 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Cisco Secure Firewall Threat Defense (FTD) is a network security appliance that inspects traffic, including encrypted connections. A memory management flaw in the Snort 3 detection engine can be triggered by specially crafted SSL packets, causing the inspection engine to unexpectedly restart and interrupt network traffic protection.

Technologies: [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20052 being exploited in the wild.

**How severe is CVE-2026-20052?** Medium severity, with a CVSS score of 5.8, published 4 March 2026.

**Which products and versions are affected?** Cisco Secure Firewall Threat Defense.

**Is there a fix for CVE-2026-20052?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20052 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20052?** Check whether you run Cisco Secure Firewall Threat Defense. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a memory management logic error (CWE-788) in the Snort 3 Detection Engine's SSL packet inspection functionality. An unauthenticated remote attacker can exploit it by sending crafted SSL packets through an established connection. The vulnerability requires Snort 3 to be enabled and an SSL decryption policy to be configured on the device. Successful exploitation causes a denial of service by forcing the Snort 3 Detection Engine to restart, temporarily disabling threat detection. Cisco has released software updates to address this issue; no workarounds are available.

## Affected products

- Cisco Secure Firewall Threat Defense

## Timeline

- 2026-03-04: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)