CVE-2026-20065: Cisco Snort 3 Detection Engine denial of service

CVE-2026-20065 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Snort 3 is a network intrusion detection and prevention engine deployed across multiple Cisco security products including firewalls, routers, and edge platforms. An unauthenticated remote attacker can send specially crafted packets to crash the Snort 3 engine, interrupting packet inspection and creating a window for malicious traffic to bypass security controls. This results in loss of visibility and protection for network traffic.

Technologies: Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Cloud Services Router 1000V, Cisco Cyber Vision, Cisco IOS XE, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20065 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20065 being exploited in the wild.
How severe is CVE-2026-20065?
Medium severity, with a CVSS score of 5.8, published 4 March 2026.
Which products and versions are affected?
Cisco Catalyst 8000V Edge Software Multiple vulnerable releases; Cisco Catalyst 8200 Series Edge Platforms Multiple vulnerable releases; Cisco Cloud Services Router 1000V Multiple vulnerable releases; Cisco Cyber Vision Multiple vulnerable releases; and 3 more.
Is there a fix for CVE-2026-20065?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20065 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20065?
Check whether you run Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Cloud Services Router 1000V or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the binder module initialization logic of the Snort 3 Detection Engine, classified as an error-handling issue (CWE-248, CWE-392). An unauthenticated, network-adjacent attacker can exploit this by sending certain packets through an established connection parsed by Snort 3, triggering an unhandled exception that causes the detection engine to restart unexpectedly. The attack requires no authentication or user interaction and is triggered on receipt of malicious packets. A successful exploit results in a denial-of-service condition interrupting packet inspection. Patches are available; no workarounds exist.

Affected products

  • Cisco Snort 3 Multiple vulnerable releases
  • Cisco Secure Firewall Threat Defense Multiple releases with Snort 3 configured
  • Cisco IOS XE Multiple releases with UTD Snort IPS Engine enabled
  • Cisco Catalyst 8000V Edge Software Multiple vulnerable releases
  • Cisco Catalyst 8200 Series Edge Platforms Multiple vulnerable releases
  • Cisco Cloud Services Router 1000V Multiple vulnerable releases
  • Cisco Cyber Vision Multiple vulnerable releases

Timeline

  • 2026-03-04: disclosed: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.