# CVE-2026-20290: Cisco Secure Firewall Threat Defense SSL/TLS denial of service in Snort 2

Source: https://junglewise.ai/threats/cve-2026-20290-cisco-secure-firewall-threat-defense-ssl-tls-denial-of-service-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20290 · Severity: medium · CVSS 5.8 · Published 2026-09-16

Cisco Secure Firewall Threat Defense (FTD) Software contains a flaw in how the Snort 2 detection engine processes SSL/TLS certificates. An attacker on the network can send a specially crafted SSL connection request that crashes the detection engine, temporarily disabling threat detection and network monitoring until the system restarts. This results in a denial-of-service condition that degrades network security oversight.

Technologies: [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20290 being exploited in the wild.

**How severe is CVE-2026-20290?** Medium severity, with a CVSS score of 5.8, published 16 September 2026.

**Which products and versions are affected?** Cisco Secure Firewall Threat Defense Multiple releases with Snort 2 configured (default on upgrades from 6.7.0 or earlier to 7.0.0+; deprecated in 7.7.0+); Open Source Snort Snort 2 All versions; final release 2.9.20 (end of life).

**Is there a fix for CVE-2026-20290?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20290 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20290?** Check whether you run Cisco Secure Firewall Threat Defense or Open Source Snort Snort 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incomplete validation flaw (CWE-805) in the Snort 2 Detection Engine's SSL/TLS certificate parsing logic. An unauthenticated, remote attacker can exploit this by sending a crafted SSL connection setup request that triggers improper handling in the certificate validation code. The attack requires only network reachability and no authentication; the malformed SSL certificate causes the Snort 2 process to crash and restart, resulting in a denial of service. Cisco has released software updates; no workarounds are available. Open Source Snort 2 has reached end of life and will not receive patches.

## Affected products

- Cisco Secure Firewall Threat Defense Multiple releases with Snort 2 configured (default on upgrades from 6.7.0 or earlier to 7.0.0+; deprecated in 7.7.0+)
- Open Source Snort Snort 2 All versions; final release 2.9.20 (end of life)

## Timeline

- 2026-09-16: disclosed: Cisco Security Advisory published

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)