CVE-2026-20236: Cisco Snort 3 incorrect calculation vulnerability

CVE-2026-20236 · Severity: high · CVSS 7.5 · Published 2026-10-21

Snort 3 is an open-source network intrusion prevention system used to detect and block malicious traffic in corporate networks. A flaw in calculation logic could allow an attacker to bypass threat detection or cause the system to malfunction, potentially letting malicious traffic pass through undetected. The vulnerability affects multiple Cisco security products that rely on Snort 3 for threat protection.

Technologies: Cisco Cloud-delivered Firewall, Cisco Cyber Vision, Cisco IOS XE, Cisco Meraki MX Security Appliances, Cisco Secure Access, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-20236 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20236 being exploited in the wild.
How severe is CVE-2026-20236?
High severity, with a CVSS score of 7.5, published 21 October 2026.
Which products and versions are affected?
Cisco Cloud-delivered Firewall all versions using affected Snort 3; Cisco Cyber Vision before 5.6.0; Cisco IOS XE all versions with Unified Threat Defense using affected Snort 3; Cisco Meraki MX Security Appliances all versions using affected Snort 3; and 3 more.
Is there a fix for CVE-2026-20236?
Yes: fixed in Snort 3 3.12.4.0; Cyber Vision 5.6.0; CDFW and CSA automatically patched as of 2026-10-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20236 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-20236?
Check whether you run Cisco Cloud-delivered Firewall, Cisco Cyber Vision, Cisco IOS XE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Snort 3 3.12.4.0; Cyber Vision 5.6.0; CDFW and CSA automatically patched as of 2026-10-21

Technical details

CVE-2026-20236 addresses an incorrect calculation vulnerability (CWE-682) in Snort 3 discovered during internal security review. The vulnerability is remotely exploitable over the network with no authentication or user interaction required, though exploitation is complex. An attacker can leverage this flaw to bypass threat detection or disrupt the intrusion prevention function, affecting all Snort 3 integrated products.

Affected products

  • Cisco Snort 3 3.x before 3.12.4.0
  • Cisco Cyber Vision before 5.6.0
  • Cisco Cloud-delivered Firewall all versions using affected Snort 3
  • Cisco Secure Access all versions using affected Snort 3
  • Cisco Secure Firewall Threat Defense all versions using affected Snort 3
  • Cisco Meraki MX Security Appliances all versions using affected Snort 3
  • Cisco IOS XE all versions with Unified Threat Defense using affected Snort 3

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.