WaratekVRT Sign in

CVE-2026-20053 Cisco Snort

Affected softwareCisco Snort
Severity5.8 Medium CVSS 3.1
WeaknessCWE-122
Published4 Mar 2026
Updated20 Aug 2026

Description

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This vulnerability is due to improper range checking when decompressing VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause an overflow of heap data, which could cause a DoS condition.

Exploitation status

No public exploit

No exploit has been reported in the sources we check.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.47% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/cyber_vision, cisco/secure_firewall_threat_defense). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

Affected software and releases

Products and versions

4 products, 120 version entries
SourceVendorProductSchemeAffected versions
nvd cisco cyber vision generic 3.0.0 · 3.0.1 · 3.0.2 · 3.0.3 · 3.0.4 · 3.0.5 · 3.0.6 · 3.1.0 · 3.1.1 · 3.1.2 · 3.2.0 · 3.2.1 · 3.2.2 · 3.2.3 · 3.2.4 · 4.0.0 · 4.0.1 · 4.0.2 · 4.0.3 · 4.1.0 · 4.1.1 · 4.1.2 · 4.1.3 · 4.1.4 · 4.1.5 · 4.1.6 · 4.1.7 · 4.2.0 · 4.2.1 · 4.2.2 · 4.2.3 · 4.2.4 · 4.2.6 · 4.3.0 · 4.3.1 · 4.3.2 · 4.3.3 · 4.4.0 · 4.4.1 · 4.4.2 · 4.4.3 · 5.0.0 · 5.0.1 · 5.0.2 · 5.1.0 · 5.1.1 · 5.1.2 · 5.1.3 · 5.2.0 · 5.2.1 · 5.3.0 · 5.3.1 · 5.3.2
nvd cisco secure firewall threat defense generic 7.2.0 · 7.2.0.1 · 7.2.1 · 7.2.2 · 7.2.3 · 7.2.4 · 7.2.4.1 · 7.2.5 · 7.2.5.1 · 7.2.5.2 · 7.2.6 · 7.2.7 · 7.2.8 · 7.2.8.1 · 7.2.9 · 7.2.10 · 7.2.10.2 · 7.3.0 · 7.3.1 · 7.3.1.1 · 7.3.1.2 · 7.4.0 · 7.4.1 · 7.4.1.1 · 7.4.2 · 7.4.2.1 · 7.4.2.2 · 7.4.2.3 · 7.4.2.4 · 7.4.3 · 7.6.0 · 7.6.1 · 7.6.2 · 7.6.2.1 · 7.7.0 · 7.7.10 · 7.7.10.1
nvd cisco snort generic ≥ 3.0.0.233 and ＜ 3.9.3.0
nvd cisco unified threat defense snort intrusion prevention system engine generic 17.9.4 · 17.9.5e · 17.12.1a · 17.12.2 · 17.12.3 · 17.12.3a · 17.12.4 · 17.12.4a · 17.12.4b · 17.12.5 · 17.12.5a · 17.12.5b · 17.12.5c · 17.12.5d · 17.12.6 · 17.13.1a · 17.14.1a · 17.15.1a · 17.15.2a · 17.15.2c · 17.15.3 · 17.15.3a · 17.15.4 · 17.15.4c · 17.16.1a · 17.17.1 · 17.18.1 · 17.18.1a · 17.18.2

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed Vendor Advisory, Mitigation

Timeline
Published2026-03-04By the CVE Program.
NVD record modified2026-08-20NVD's own last-modified date for this record.