CVE-2026-20066: Cisco Snort 3 Detection Engine denial of service in HTTP JavaScript normalization

CVE-2026-20066 · Severity: medium · CVSS 5.8 · Published 2026-03-04

Cisco products using Snort 3 detection engine contain a flaw in HTTP JavaScript normalization that allows remote attackers to crash the inspection engine. When Snort 3 restarts unexpectedly, packet inspection is interrupted, potentially leaving network traffic uninspected and exposing the protected network. This could disrupt security monitoring and allow malicious traffic to pass undetected during outages.

Technologies: Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms, Cisco Catalyst 8500L Edge Platforms, Cisco Cyber Vision, Cisco IOS XE, Cisco Secure Firewall Threat Defense. Vendors: Cisco.

Quick answers

Is CVE-2026-20066 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20066 being exploited in the wild.
How severe is CVE-2026-20066?
Medium severity, with a CVSS score of 5.8, published 4 March 2026.
Which products and versions are affected?
Cisco Open Source Snort 3; Cisco Secure Firewall Threat Defense; Cisco IOS XE; Cisco Catalyst 8000V Edge Software; and 5 more.
Is there a fix for CVE-2026-20066?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20066 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20066?
Check whether you run Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the JSTokenizer normalization logic when Snort 3 performs HTTP inspection of JavaScript content. An unauthenticated, remote attacker can send crafted HTTP packets through an established connection that triggers an error in this normalization logic, causing the Snort 3 Detection Engine to restart unexpectedly and resulting in a denial of service condition. The attack requires the JSTokenizer feature to be active (it is not enabled by default). The vulnerable component is part of Snort 3, which is included in Cisco Secure Firewall Threat Defense (FTD), IOS XE with Unified Threat Defense (UTD), and other Cisco security products. Cisco has released software updates addressing this vulnerability.

Affected products

  • Cisco Open Source Snort 3
  • Cisco Secure Firewall Threat Defense
  • Cisco IOS XE
  • Cisco Catalyst 8000V Edge Software
  • Cisco Catalyst 8200 Series Edge Platforms
  • Cisco Catalyst 8300 Series Edge Platforms
  • Cisco Catalyst 8500L Edge Platforms
  • Cisco Cloud Services Routers 1000V
  • Cisco Cyber Vision

Timeline

  • 2026-03-04: disclosed: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.