CVE-2026-20065
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability in the Snort 3 Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the engine to restart, interrupting packet inspection. The issue is due to an error in the binder module initialization logic. Exploitation involves sending certain packets through an established connection.
Risk Assessment
Successful exploitation could lead to a denial-of-service condition, causing unexpected restarts of the Snort 3 Detection Engine and disrupting network traffic monitoring.
Recommendation
Apply updates provided by Cisco for products using the Snort 3 engine. Monitor vendor advisories and deploy patches as soon as possible.
Other vulnerabilities in Snort 3 Detection Engine
See all- CVE-2026-76445Medium
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.
- CVE-2026-20221Medium
Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the binder module initialization logic of the Snort Detection Engine. An attacker could exploit this vulnerability by sending certain packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS