Zero Radar
← feed
HighVulnerabilityCVE-2026-20291updated 25 Oct 2026, 15:20 UTC

Cisco Snort 3 privilege management flaw; Cisco confirms exploitation

A flaw in Cisco's Snort 3 security software could let someone gain more access on the system than they should have. Cisco says this flaw has been used in real attacks.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.8 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 22 Oct 2026
Fix available?YesCisco has released software updates for the affected products (specific fixed versions not stated in the provided material). · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

CVE-2026-20291 is an improper privilege management weakness (CWE-269) in the open source Snort 3 engine used in Cisco products, found during Cisco's internal hardening review.

Why it is dangerous: An attacker who can reach the affected device could gain elevated privileges, potentially taking control of the Snort component and the surrounding system. Organizations running Cisco products with Snort 3 are at risk.

Are you affected?

You are affected if you run Cisco products that include Snort 3 in a version earlier than the fixed release listed in Cisco's advisory.

Cisco products that include Snort 3 (specific product list and versions are in Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe; not stated in the provided material).

What to do

  1. Check your Cisco products for Snort 3 and identify their current versions
  2. Install the software update from Cisco's advisory cisco-sa-hardening-snort3-ybgmhTQe
  3. Review the advisory for the other related CVEs in this release (CVE-2026-20043, CVE-2026-20236, CVE-2026-20356)

Timeline

  1. 21 Oct 2026, 17:18 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 25 Oct 2026, 15:20 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-20291
CVSS
7.8 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Snort 3 privilege management flaw; Cisco confirms exploitation · Zero Radar