Zero Radar
← feed
CriticalVulnerabilityCVE-2026-20043updated 25 Oct 2026, 15:20 UTC

Cisco Snort 3 has memory write flaws that may let attackers take control

Snort is a network security tool that inspects traffic. Bugs in it can let an attacker write data outside the memory space meant for it, which can crash the tool or let the attacker run their own commands.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 22 Oct 2026
Fix available?YesSoftware updates released by Cisco in the October 2026 Snort 3 security hardening release. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends trafficCrafted network packets sent to device
  2. 2Snort 3 parses dataEngine processes the malicious input
  3. 3Out-of-bounds writeMemory written outside its intended bounds
  4. 4Device compromisedAttacker may crash or control the process
  5. ResultAttacker may gain control of the device

What happened

Out-of-bounds write vulnerabilities (CWE-787) in Cisco's open source Snort 3 engine, found during an internal security review and fixed in hardening releases.

Why it is dangerous: A successful attack could let someone take over a device running Snort 3 or disrupt the network protection it provides. Organizations using Cisco products that bundle Snort 3 are at risk.

Are you affected?

You are affected if you run a Cisco product that includes Snort 3 software versions that predate the October 2026 hardening releases.

Cisco products that include Snort 3 (specific product list and versions are in the linked Cisco advisory, not in the provided material).

What to do

  1. Identify all Cisco products in your environment that include Snort 3.
  2. Apply the Cisco software update from the October 2026 Snort 3 security hardening release (see cisco-sa-hardening-snort3-ybgmhTQe).
  3. Check the related advisories in Cisco's October 21, 2026 group for other fixes that affect the same products.
  4. Prioritize internet-facing and critical network devices for patching first.

Timeline

  1. 21 Oct 2026, 17:18 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 25 Oct 2026, 15:20 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-20043
CVSS
9 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Snort 3 has memory write flaws that may let attackers take control · Zero Radar