# Cisco patches multiple Snort 3 DoS flaws

Published: 2026-10-22 · Severity: routine
Canonical: https://vorant.io/reports/700d86a8-d7f1-5abd-ad40-ab2927b15dad/cisco-patches-multiple-snort-3-dos-flaws

> Cisco fixed 13 vulnerabilities in Snort 3's detection engine allowing unauthenticated remote DoS and local privilege escalation to command execution.

NCSC-NL published an advisory summarizing 13 CVEs that Cisco has patched in Snort 3, the open-source IDS/IPS engine embedded in multiple Cisco security products. The flaws span several detection engine components including the SMTP MIME decoder, NetFlow, GRE, Teredo, and VBA decompression engines, as well as general memory management. Most of the vulnerabilities (stack-based buffer overflow, NULL pointer dereference, out-of-bounds write, wrap-around errors, infinite loops) allow an unauthenticated remote attacker to send specially crafted packets or datagrams that crash the detection engine, causing a denial of service and a corresponding gap in traffic inspection and threat detection.

One notable flaw involves missing authentication on the Snort 3 control channel socket, which could allow a low-privileged, authenticated local attacker to execute arbitrary commands and access the Snort 3 process memory. The highest-rated issue, CVE-2026-20043, carries a CVSS score of 9.0. Cisco has released software updates and hardening guidance across six separate security advisories referenced in the bulletin; there is no indication in this advisory of active exploitation in the wild. Defenders running Cisco products that embed Snort 3 should prioritize patching per Cisco's linked advisories, particularly for internet-facing or untrusted-traffic-exposed deployments where the DoS vectors are most impactful.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20011, CVE-2026-20019, CVE-2026-20043, CVE-2026-20179, CVE-2026-20197, CVE-2026-20218, CVE-2026-20221, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76445, CVE-2026-76489, CVE-2026-76524

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0450.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/700d86a8-d7f1-5abd-ad40-ab2927b15dad/cisco-patches-multiple-snort-3-dos-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup