Is CVE-2026-76489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76489 being exploited in the wild.

How severe is CVE-2026-76489?

Medium severity, with a CVSS score of 5.8, published 21 October 2026.

Is there a fix for CVE-2026-76489?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76489 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-76489?

Check whether you run Cisco IOS XE Unified Threat Defense, Cisco Meraki MX Security Appliances, Cisco Secure Firewall Threat Defense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76489: Cisco Snort 3 memory management denial of service

CVE-2026-76489 · Severity: medium · CVSS 5.8 · Published 2026-10-21

Multiple Cisco products that use Snort 3 for network threat detection are vulnerable to a denial-of-service attack when processing malformed files over the network. An unauthenticated attacker can send specially crafted packets to crash the Snort detection engine, disabling network inspection and threat protection until the system restarts. This vulnerability affects firewalls, routers, and security appliances used to protect corporate networks from cyberattacks.

Technologies: Cisco IOS XE Unified Threat Defense, Cisco Meraki MX Security Appliances, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2026-76489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76489 being exploited in the wild.
How severe is CVE-2026-76489?: Medium severity, with a CVSS score of 5.8, published 21 October 2026.
Which products and versions are affected?: Cisco IOS XE Unified Threat Defense <UNKNOWN>; Cisco Meraki MX Security Appliances <UNKNOWN>; Cisco Secure Firewall Threat Defense <UNKNOWN>; Cisco Snort 3 <UNKNOWN>.
Is there a fix for CVE-2026-76489?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76489 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76489?: Check whether you run Cisco IOS XE Unified Threat Defense, Cisco Meraki MX Security Appliances, Cisco Secure Firewall Threat Defense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a memory management flaw (CWE-119, CWE-128, CWE-401) in Snort 3's file processing logic due to incomplete error checking. An unauthenticated remote attacker can send a large number of files or malformed NetFlow protocol connections to trigger unreleased memory and cause the detection engine to restart unexpectedly. The attack requires Snort 3 to be actively configured for NetFlow parsing and can be delivered over the network without authentication.

Affected products

Cisco Snort 3 <UNKNOWN>
Cisco Secure Firewall Threat Defense <UNKNOWN>
Cisco IOS XE Unified Threat Defense <UNKNOWN>
Cisco Meraki MX Security Appliances <UNKNOWN>

Timeline

2026-10-21: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.