Security alerts · October 28, 2026

Critical Snort 3 flaws put Cisco FTD firewalls, Meraki MX and IOS XE routers at risk

On October 21, 2026, Cisco fixed a batch of flaws in the Snort 3 inspection engine used by its firewalls and security gateways. The most serious score 9.0 on CVSS. No exploitation is known yet, but there is no workaround, so updating is the only real protection.

What happened

Snort is the “brain” behind many firewalls and intrusion detection systems. It inspects the network traffic passing through a device and looks for signs of attacks. Cisco owns Snort, and its Snort 3 version runs inside Secure Firewall Threat Defense (FTD), Meraki MX appliances, IOS XE routers and Cisco cloud security services.

The Snort 3 engineering team ran a large internal security review, using its existing testing processes as well as frontier AI models. It found a number of bugs, which Cisco grouped by type under four identifiers: CVE-2026-20043, CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356.

Cisco published the fixes on October 21, 2026 and rated the advisory as critical. A day later, on October 22, 2026, it updated the table of fixed IOS XE releases. According to Cisco, the bugs were found internally and the company is not aware of any public disclosure or malicious use.

Why it is dangerous

The most serious group, CVE-2026-20043, is an out-of-bounds write. Picture a form with a ten-character box where someone types a hundred characters and the text spills into the neighbouring boxes. A bug like this can crash a program or, in the worst case, let foreign instructions run. The second group, CVE-2026-20236, covers incorrect calculations, such as getting the size of incoming data wrong.

What makes this dangerous is where Snort sits. It also inspects traffic coming from the internet. According to the CVSS vector for CVE-2026-20043, an attacker needs no login and no help from a user. If successful, they could affect the firewall itself, which is the gateway to your entire network. The same vector says the attack is technically demanding and depends on extra conditions. For CVE-2026-20236, the NVD vector lists an impact on availability only, so the main risk is an outage.

CVSS is a 0 to 10 severity scale. In the National Vulnerability Database (NVD), CVE-2026-20043 has a CVSS 3.1 score of 9.0, which is critical. CVE-2026-20236 shows 7.5 in NVD, but Cisco rates it 9.0 in its advisory. Cisco’s score reflects the single worst bug within each group. Cisco rates the other two groups, CVE-2026-20291 and CVE-2026-20356, at 7.8 and 7.5.

As of October 28, 2026, the CISA KEV catalog, the US list of vulnerabilities confirmed as exploited in the wild, does not include these flaws. The European EUVD database does not list any exploitation either. EPSS estimates the probability of exploitation within the next 30 days. For both CVEs it is below half a percent, which is low. That is still no reason to wait, because there is no workaround.

Who is affected

Cisco lists the following products as affected, regardless of configuration:

  • Cisco Secure Firewall Threat Defense (FTD), trains 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1 before the fixed releases
  • Unified Threat Defense (UTD) on Cisco IOS XE, trains 17.12, 17.15, 17.18, 26.1 and 26.2
  • Cisco Meraki MX Security Appliances
  • Cisco Cyber Vision before 5.6.0
  • Open Source Snort 3 before 3.12.4.0
  • Cisco Cloud-delivered Firewall (CDFW) and Cisco Secure Access (CSA) cloud services

In practice, this means perimeter firewalls, branch routers with intrusion prevention turned on, and industrial networks monitored with Cyber Vision. The older Snort 2 is not affected, although it is no longer supported. Cisco says only the listed products are known to be affected.

How to check if you are affected

On an FTD firewall, log in to the CLI and check the software version. You can also see it in Firewall Management Center or Device Manager under the device overview.

show version

On an IOS XE router, check the system version and whether the UTD container running Snort is active. Both commands are read-only.

show version
show app-hosting list

If you run standalone Open Source Snort 3 on Linux, this prints the version:

snort -V

For Cyber Vision, the version is shown in the administration section of the web interface. For Meraki MX, check in the Meraki Dashboard that the appliance is online and connected.

How to fix it

Cisco states plainly that there is no workaround. The only protection is upgrading to a fixed release:

  • Secure FTD: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0, depending on your train
  • UTD on IOS XE: 17.12.8, 17.15.6, 17.18.5, 26.1.2 or 26.2.1
  • Cyber Vision: 5.6.0, older releases need to be migrated to a fixed one
  • Open Source Snort 3: 3.12.4.0

Meraki MX needs no manual action. Cisco says that as of October 21, 2026, every affected appliance that is online and connected to the Meraki Dashboard was updated automatically. Check any units that were offline or disconnected at that time. For the CDFW and CSA cloud services, Cisco’s advisory gives no customer steps, so contact Cisco support if in doubt.

Suggested order:

  • List every Cisco device that runs Snort 3, along with its version.
  • Start with perimeter firewalls that receive traffic from the internet.
  • Back up the configuration first and confirm the device has enough memory for the new release.
  • Schedule the upgrade in a maintenance window, then verify the version and that traffic flows normally.
  • Without a service contract, Cisco TAC will provide the fix free of charge if you supply the serial number and the advisory link.

What if you may already be compromised

Cisco knows of no exploitation and its advisory lists no indicators of compromise. If you have put off updating for a long time, a basic check is still worthwhile:

  • Unexpected crashes or restarts of the Snort process or the whole device in the system logs.
  • Configuration changes nobody on your team made.
  • Unknown admin accounts or logins from unusual addresses.
  • Unusual outbound connections originating from the firewall itself.

If you find anything suspicious, do not power off the device or delete anything, so the evidence is preserved. Contact Cisco TAC or an incident response firm.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

← All alerts · RSS

Need help patching or checking your systems?

I can help you find out which systems are affected, update them safely and check whether an attacker already got in. Let us start with an initial consultation, which is deducted from the project price if we work together.

See pricing jozef@walterstein.eu