CVE-2026-20052
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This is due to a logic error in memory management during SSL packet inspection. A successful exploit could cause a DoS condition.
Risk Assessment
An attacker can cause the detection engine to restart, leading to unavailability of network protection services and potential bypass of malicious traffic.
Recommendation
Apply security updates provided by Cisco for FTD software.
Other vulnerabilities in Cisco Secure Firewall Threat Defense
See all- CVE-2026-20064Medium
A vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software allows an authenticated local attacker with a low-privileged account to cause the device to unexpectedly reload, resulting in a DoS condition. This is due to improper validation of user-supplied input.
- CVE-2026-20017Medium
A vulnerability in the CLI of Cisco Secure FTD Software allows an authenticated local attacker with administrative credentials to execute arbitrary commands on the underlying operating system as root. This is due to insufficient input validation of user-supplied command arguments.
- CVE-2026-20007Medium
A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to bypass configured Snort rules and allow traffic onto the network that should have been dropped. This is due to a logic error in the integration of Snort Engine rules with FTD Software.
- CVE-2026-20006Medium
A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a DoS condition. This is due to improper implementation of the TLS protocol. TLS 1.3 is not affected.
Original NVD description (English source)
A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.