Zero Radar
← feed
HighVulnerabilityCVE-2026-20236updated 25 Oct 2026, 15:22 UTC

Cisco Snort 3 intrusion detection engine: incorrect calculation flaw

Cisco's Snort 3 security engine has a bug in how it does some internal math, which can cause a security flaw. Cisco has confirmed it is being exploited.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 22 Oct 2026
Fix available?YesSoftware updates in the Cisco Snort 3 Security Hardening Release: October 2026. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

CVE-2026-20236 is a high-severity (CVSS 7.5) incorrect-calculation flaw (CWE-682) in the Snort 3 detection engine used by multiple Cisco products. It was found during Cisco's internal Snort 3 hardening review and is grouped with other hardening fixes in the October 2026 release.

Why it is dangerous: Cisco confirms the flaw is exploited, so attackers may be able to abuse affected Cisco security appliances that rely on Snort 3 for inspection. Organizations running these Cisco products are at risk.

Are you affected?

You are affected if you run a Cisco product that includes the Snort 3 detection engine on a version older than the October 2026 Snort 3 hardening release.

Multiple Cisco products running Snort 3 prior to the October 2026 hardening release (specific product and version list not stated in the provided material).

What to do

  1. Identify which Cisco products in your environment run Snort 3 and their current versions
  2. Update affected Cisco products to the software release from the October 2026 Snort 3 Security Hardening Release
  3. Review the Cisco security advisory for the complete list of fixed versions for your product

Timeline

  1. 21 Oct 2026, 17:18 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:18 UTC
    Reported by NVD · NVD
  3. 22 Oct 2026, 17:03 UTC
    Reported by Cisco PSIRT · Cisco PSIRT
  4. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  5. 25 Oct 2026, 15:20 UTC
    Confirmed by Cisco PSIRT

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-20236
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Snort 3 intrusion detection engine: incorrect calculation flaw · Zero Radar