# CVE-2026-20058: Cisco Snort 3 VBA decompression denial of service

Source: https://junglewise.ai/threats/cve-2026-20058-cisco-snort-3-vba-decompression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20058 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Cisco's Snort 3 intrusion detection engine contains flaws in how it handles Visual Basic for Applications (VBA) macro decompression, which is used to inspect email and web traffic for malicious content. An attacker can craft malicious VBA data that causes the detection engine to crash unexpectedly, disrupting security monitoring and creating a temporary window of vulnerability.

Technologies: [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe), [Cisco Secure Firewall Management Center (FMC)](https://junglewise.ai/threats/technologies/secure-firewall-management-center-fmc), [Cisco Secure Firewall Threat Defense (FTD)](https://junglewise.ai/threats/technologies/firepower-threat-defense-software), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20058 being exploited in the wild.

**How severe is CVE-2026-20058?** Medium severity, with a CVSS score of 5.8, published 4 March 2026.

**Which products and versions are affected?** Cisco IOS XE Releases with vulnerable UTD Snort IPS Engine; Cisco Secure Firewall Management Center (FMC) Vulnerable releases as per March 2026 advisory; Cisco Secure Firewall Threat Defense (FTD) 7.2.0 and later (with Snort 3 and VBA decompression configured); Cisco Snort 3 Vulnerable releases as documented in Fixed Software section of advisory.

**Is there a fix for CVE-2026-20058?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20058 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20058?** Check whether you run Cisco IOS XE, Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Threat Defense (FTD) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Snort 3 VBA decompression feature due to improper error checking when decompressing VBA data (CWE-122, CWE-369, CWE-786, CWE-835). An unauthenticated, remote attacker can send crafted VBA payloads to a device running vulnerable Snort 3 detection engine via network protocols that support VBA inspection (IMAP, SMTP, HTTP, POP3). The attack requires Snort 3 to be active and at least one Snort 3 Detector configured for VBA macro decompression (a non-default feature). Successful exploitation causes the Snort 3 Detection Engine to crash, resulting in a denial of service condition and loss of intrusion detection capabilities until the engine restarts.

## Affected products

- Cisco Snort 3 Vulnerable releases as documented in Fixed Software section of advisory
- Cisco Secure Firewall Threat Defense (FTD) 7.2.0 and later (with Snort 3 and VBA decompression configured)
- Cisco IOS XE Releases with vulnerable UTD Snort IPS Engine
- Cisco Secure Firewall Management Center (FMC) Vulnerable releases as per March 2026 advisory

## Timeline

- 2026-03-04: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)