CVE-2026-20290
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Incomplete validation of SSL certificates in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated remote attacker to cause the engine to restart. The attacker sends a crafted SSL connection setup request, resulting in a denial of service (DoS) condition.
Risk Assessment
Repeated restarts of the Snort 2 engine can disrupt threat detection and may create gaps in network protection. This poses a risk to the availability of security functions.
Recommendation
Immediately apply the Cisco fix for Snort 2 in FTD and monitor logs for unusual engine restarts.
Other vulnerabilities in Cisco Secure Firewall Threat Defense (FTD) Software
Original NVD description (English source)
A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS