# CVE-2026-76445: Cisco Snort 3 Detection Engine denial of service in GTP codec

Source: https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76445 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Cisco's Snort 3 Detection Engine, which protects networks by analyzing traffic for threats, contains a vulnerability that allows unauthenticated remote attackers to crash it by sending specially crafted network packets. A successful attack causes the detection engine to stop working, disabling threat detection and creating an opportunity for malicious traffic to pass through undetected.

Technologies: [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe), [Cisco Meraki MX Series](https://junglewise.ai/threats/technologies/meraki-mx-series), [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76445 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76445 being exploited in the wild.

**How severe is CVE-2026-76445?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Cisco IOS XE Vulnerable releases with Unified Threat Defense Snort IPS Engine; Cisco Meraki MX Series MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W, MX68, MX68CW, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600; vulnerable releases per fixed software; Cisco Secure Firewall Threat Defense Vulnerable versions per fixed software section; Cisco Snort 3 Open Source Snort 3 versions vulnerable at time of publication; see fixed software section.

**Is there a fix for CVE-2026-76445?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76445 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-76445?** Check whether you run Cisco IOS XE, Cisco Meraki MX Series, Cisco Secure Firewall Threat Defense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw in GTP extension header processing within the Snort 3 codec causes an infinite loop when handling crafted, fragmented UDP datagrams. An unauthenticated network attacker can trigger this by sending specially formed packets to the detection engine, causing it to restart and resulting in denial of service. The vulnerability affects multiple Cisco products that embed or run Snort 3, with fixes available in patched software releases.

## Affected products

- Cisco Snort 3 Open Source Snort 3 versions vulnerable at time of publication; see fixed software section
- Cisco Secure Firewall Threat Defense Vulnerable versions per fixed software section
- Cisco IOS XE Vulnerable releases with Unified Threat Defense Snort IPS Engine
- Cisco Meraki MX Series MX64, MX64W, MX65, MX65W, MX67, MX67C, MX67W, MX68, MX68CW, MX75, MX84, MX85, MX95, MX100, MX105, MX250, MX400, MX450, MX600; vulnerable releases per fixed software

## Timeline

- 2026-10-21: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco multiple products Snort 3 GRE tunnel denial of service](https://junglewise.ai/threats/cve-2026-20221-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)