# CVE-2026-20053: Cisco Snort 3 VBA decompression denial of service

Source: https://junglewise.ai/threats/cve-2026-20053-cisco-snort-3-vba-decompression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20053 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Snort 3 is a network intrusion detection and prevention engine used in Cisco firewalls and routers to monitor traffic for malicious activity. A vulnerability in the VBA file decompression feature allows remote attackers to send crafted files that crash the detection engine, disabling security monitoring and creating a denial of service condition.

Technologies: [Cisco Catalyst 8000V Edge Software](https://junglewise.ai/threats/technologies/catalyst-8000v-edge-software), [Cisco Catalyst 8200 Series Edge Platforms](https://junglewise.ai/threats/technologies/catalyst-8200-series-edge-platforms), [Cisco Catalyst 8300 Series Edge Platforms](https://junglewise.ai/threats/technologies/catalyst-8300-series-edge-platforms), [Cisco Catalyst 8500L Edge Platforms](https://junglewise.ai/threats/technologies/catalyst-8500l-edge-platforms), [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe), [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20053 being exploited in the wild.

**How severe is CVE-2026-20053?** Medium severity, with a CVSS score of 5.8, published 4 March 2026.

**Which products and versions are affected?** Cisco Catalyst 8000V Edge Software vulnerable releases with UTD enabled; Cisco Catalyst 8200 Series Edge Platforms vulnerable releases with UTD enabled; Cisco Catalyst 8300 Series Edge Platforms vulnerable releases with UTD enabled; Cisco Catalyst 8500L Edge Platforms vulnerable releases with UTD enabled; and 3 more.

**Is there a fix for CVE-2026-20053?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20053 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20053?** Check whether you run Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Snort 3's Visual Basic for Applications (VBA) decompression engine due to improper range checking when decompressing user-controlled VBA data. An unauthenticated, remote attacker can send crafted VBA data to trigger a heap buffer overflow, causing the Snort 3 Detection Engine to unexpectedly restart and resulting in a denial of service condition. The vulnerability affects multiple Cisco products running Snort 3, including Secure Firewall Threat Defense (FTD), IOS XE devices with Unified Threat Defense (UTD) enabled, and open-source Snort 3. VBA decompression is not enabled by default in FTD, but affects IMAP, SMTP, HTTP, and POP3 inspection engines when configured. Cisco has released software updates; workarounds are available.

## Affected products

- Cisco Snort 3 Open source releases (specific versions in advisory)
- Cisco Secure Firewall Threat Defense 7.2.0 and later with Snort 3 enabled
- Cisco IOS XE releases with Unified Threat Defense (UTD) Snort IPS Engine
- Cisco Catalyst 8000V Edge Software vulnerable releases with UTD enabled
- Cisco Catalyst 8200 Series Edge Platforms vulnerable releases with UTD enabled
- Cisco Catalyst 8300 Series Edge Platforms vulnerable releases with UTD enabled
- Cisco Catalyst 8500L Edge Platforms vulnerable releases with UTD enabled

## Timeline

- 2026-03-04: advisory: Cisco security advisory published (cisco-sa-ftd-snort3-vbavuls-96UcVVed)

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)