CVE-2026-20058: Cisco Snort 3 VBA decompression denial of service

CVE-2026-20058 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Cisco's Snort 3 intrusion detection engine contains flaws in how it handles Visual Basic for Applications (VBA) macro decompression, which is used to inspect email and web traffic for malicious content. An attacker can craft malicious VBA data that causes the detection engine to crash unexpectedly, disrupting security monitoring and creating a temporary window of vulnerability.

Technologies: Cisco IOS XE, Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Threat Defense (FTD), Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20058 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20058 being exploited in the wild.
How severe is CVE-2026-20058?
Medium severity, with a CVSS score of 5.8, published 4 March 2026.
Which products and versions are affected?
Cisco IOS XE Releases with vulnerable UTD Snort IPS Engine; Cisco Secure Firewall Management Center (FMC) Vulnerable releases as per March 2026 advisory; Cisco Secure Firewall Threat Defense (FTD) 7.2.0 and later (with Snort 3 and VBA decompression configured); Cisco Snort 3 Vulnerable releases as documented in Fixed Software section of advisory.
Is there a fix for CVE-2026-20058?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20058 attacked?
It is attacked over the network.
Am I affected by CVE-2026-20058?
Check whether you run Cisco IOS XE, Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Threat Defense (FTD) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Snort 3 VBA decompression feature due to improper error checking when decompressing VBA data (CWE-122, CWE-369, CWE-786, CWE-835). An unauthenticated, remote attacker can send crafted VBA payloads to a device running vulnerable Snort 3 detection engine via network protocols that support VBA inspection (IMAP, SMTP, HTTP, POP3). The attack requires Snort 3 to be active and at least one Snort 3 Detector configured for VBA macro decompression (a non-default feature). Successful exploitation causes the Snort 3 Detection Engine to crash, resulting in a denial of service condition and loss of intrusion detection capabilities until the engine restarts.

Affected products

  • Cisco Snort 3 Vulnerable releases as documented in Fixed Software section of advisory
  • Cisco Secure Firewall Threat Defense (FTD) 7.2.0 and later (with Snort 3 and VBA decompression configured)
  • Cisco IOS XE Releases with vulnerable UTD Snort IPS Engine
  • Cisco Secure Firewall Management Center (FMC) Vulnerable releases as per March 2026 advisory

Timeline

  • 2026-03-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.