CVE-2026-20197: Cisco Snort 3 Teredo detection engine denial of service

CVE-2026-20197 · Severity: medium · CVSS 5.8 · Published 2026-10-21

Multiple Cisco security products, including Secure Firewall Threat Defense and Meraki MX appliances, use a packet inspection engine called Snort 3 that can crash when processing specially crafted Teredo protocol packets. An attacker can exploit this remotely by sending a malformed packet, causing the inspection engine to restart and stop protecting the network temporarily.

Technologies: Cisco Cloud Services Router 1000V, Cisco IOS XE Unified Threat Defense, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20197 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20197 being exploited in the wild.
How severe is CVE-2026-20197?
Medium severity, with a CVSS score of 5.8, published 21 October 2026.
Which products and versions are affected?
Cisco Secure Firewall Threat Defense vulnerable releases with Snort 3 enabled.
Is there a fix for CVE-2026-20197?
No fixed version is recorded yet. No workarounds are available. Cisco has released software updates; deploy them when available. Ensure Snort 3 is only enabled where necessary on FTD systems, and verify that Unified Threat Defense (UTD) is explicitly enabled on routers using the show utd engine standard status command before assuming the device is affected. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20197 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20197?
Check whether you run Cisco Catalyst 8000V Edge, Cisco Catalyst 8100 Series, Cisco Catalyst 8200 Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

No workarounds are available. Cisco has released software updates; deploy them when available. Ensure Snort 3 is only enabled where necessary on FTD systems, and verify that Unified Threat Defense (UTD) is explicitly enabled on routers using the show utd engine standard status command before assuming the device is affected.

Technical details

The vulnerability exists in Snort 3's Teredo packet parser due to incomplete error checking (CWE-119, CWE-128, CWE-401), which allows an unauthenticated remote attacker to craft a Teredo packet that triggers an unexpected engine restart. The attack requires no user interaction or authentication; only network access to send a packet to an affected device running Snort 3. A successful exploit causes denial of service by interrupting packet inspection.

Affected products

  • Cisco Snort 3
  • Cisco Secure Firewall Threat Defense vulnerable releases with Snort 3 enabled
  • Cisco IOS XE Unified Threat Defense
  • Cisco Meraki MX64
  • Cisco Meraki MX65
  • Cisco Meraki MX67
  • Cisco Meraki MX68
  • Cisco Meraki MX75
  • Cisco Meraki MX84
  • Cisco Meraki MX85
  • Cisco Meraki MX95
  • Cisco Meraki MX100
  • Cisco Meraki MX105
  • Cisco Meraki MX250
  • Cisco Meraki MX400
  • Cisco Meraki MX450
  • Cisco Meraki MX600
  • Cisco ISR 1000 Series
  • Cisco ISR 4000 Series
  • Cisco Catalyst 8000V Edge
  • Cisco Catalyst 8100 Series
  • Cisco Catalyst 8200 Series
  • Cisco Catalyst 8300 Series
  • Cisco Catalyst 8400 Series
  • Cisco Catalyst 8500L
  • Cisco Catalyst IR1800 Rugged Series
  • Cisco Catalyst IR8340 Rugged
  • Cisco Cloud Services Router 1000V

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.