CVE-2026-20027
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Multiple Cisco products are affected by an out-of-bounds read in buffer handling when processing DCE/RPC requests in the Snort 3 Detection Engine. An unauthenticated remote attacker could send many requests over an established connection to obtain sensitive information from the Snort 3 data stream.
Risk Assessment
This may lead to leakage of sensitive data from traffic inspection, posing a confidentiality risk.
Recommendation
Update Cisco products to the latest patched version and consider restricting access to interfaces inspected by Snort 3.
Other vulnerabilities in Cisco Snort 3
See all- CVE-2026-20057Medium
A vulnerability in the VBA feature of the Snort 3 engine in multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This is due to lack of proper error checking when decompressing VBA data. A successful exploit could cause the engine to unexpectedly restart, leading to a DoS condition.
- CVE-2026-20054Medium
A vulnerability in the VBA feature of the Snort 3 engine in multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This is due to improper error checking when decompressing VBA data. A successful exploit could cause the engine to enter an infinite loop, leading to a DoS condition.
- CVE-2026-20053Medium
A vulnerability in the VBA feature of the Snort 3 engine in multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This is due to improper range checking when decompressing user-controlled VBA data. A successful exploit could cause an overflow of heap data, leading to a DoS condition.
- CVE-2026-20026Medium
Multiple Cisco products are affected by a vulnerability in DCE/RPC request processing that can cause a buffer use-after-free read. An unauthenticated remote attacker could send many DCE/RPC requests over an established connection to leak sensitive information or restart the Snort 3 Detection Engine.
- CVE-2022-20943Medium
Multiple vulnerabilities in the SMB2 processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass configured policies or cause a denial of service (DoS) condition. This is due to improper management of system resources when processing SMB2 traffic. An attacker could send a high rate of SMB2 packets to trigger a reload of the Snort process. With preserve-connection enabled (default), policy bypass and malicious payload delivery are also possible.
- CVE-2021-1495Medium
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, bypassing the policy and delivering a malicious payload.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in buffer handling logic when processing DCE/RPC requests, which can result in a buffer out-of-bounds read. An attacker could exploit this vulnerability by sending a large number of DCE/RPC requests through an established connection that is inspected by Snort 3. A successful exploit could allow the attacker to obtain sensitive information in the Snort 3 data stream.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS