CVE-2026-20221
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.
Risk Assessment
An attacker can trigger a restart of the detection engine, potentially bypassing IDS/IPS rules or interrupting protection. The engine restarts automatically, but traffic may go uninspected during that time.
Recommendation
Apply Cisco updates containing the Snort 3 fix. Monitor engine restarts and consider additional perimeter protections.
Other vulnerabilities in Snort 3 Detection Engine
See all- CVE-2026-76445Medium
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.
- CVE-2026-20065Medium
A vulnerability in the Snort 3 Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the engine to restart, interrupting packet inspection. The issue is due to an error in the binder module initialization logic. Exploitation involves sending certain packets through an established connection.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS