Zero Radar
← feed
HighVulnerabilityCVE-2026-20356updated 25 Oct 2026, 15:20 UTC

Cisco Snort 3 hardening release fixes uncontrolled resource consumption flaws

Snort 3, a network inspection engine inside some Cisco products, has flaws that could let an attacker overload it so it slows down or stops working. Cisco says these were found in its own review and that the issue is already being exploited

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 22 Oct 2026
Fix available?YesCisco software updates released with the October 2026 Snort 3 security hardening release; exact fixed versions not stated in the provided material. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends trafficCrafted input sent to the device
  2. 2Snort 3 processes itInspection engine handles the input
  3. 3Resources consumedCPU or memory usage climbs without limit
  4. 4Device slows or failsInspection and traffic handling degrade
  5. ResultNetwork inspection disrupted or halted

What happened

Cisco's Open Source Snort 3 engineering team found multiple internal flaws classified as uncontrolled resource consumption (CWE-400) and released hardened software to address them. Cisco PSIRT confirms exploitation of CVE-2026-20356.

Why it is dangerous: Attackers can exhaust the device's CPU or memory, degrading or halting network inspection and traffic handling, which can leave networks exposed or disrupted.

Are you affected?

You are affected if you run a Cisco product that includes Snort 3 and has not installed the October 2026 Snort 3 hardening release.

Multiple Cisco products running Snort 3 (specific product and version list is in the Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe; not stated in the provided material).

What to do

  1. Check the Cisco advisory cisco-sa-hardening-snort3-ybgmhTQe to identify affected products and versions
  2. Install the Cisco software update that includes the October 2026 Snort 3 hardening release
  3. Verify the Snort 3 version on your devices after the update
  4. Note that no workarounds exist, so patching is the only fix

Timeline

  1. 21 Oct 2026, 17:18 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 25 Oct 2026, 15:20 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-20356
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Snort 3 hardening release fixes uncontrolled resource consumption flaws · Zero Radar