CVE-2026-20005
published 2026-03-04CVE-2026-20005: Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort…
PriorityP335medium5.8CVSS 3.1
AVNACLPRNUINSCCNINAL
EPSS
0.52%
43.4th percentile
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete parsing of the SSL handshake ingress packets. An attacker could exploit this vulnerability by sending crafted SSL handshake packets. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine restarts unexpectedly.
Affected
212 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
| cisco | cisco_cyber_vision | — | — |
CVSS provenance
nvdv3.15.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cisco Cyber Vision Snort 3 Detection Engine error condition (cisco-sa-snort3-multi-dos-XFWkWSwz)
vuldb·2026-09-02·CVSS 5.8
CVE-2026-20005 [MEDIUM] Cisco Cyber Vision Snort 3 Detection Engine error condition (cisco-sa-snort3-multi-dos-XFWkWSwz)
A vulnerability, which was classified as problematic, was found in Cisco Cyber Vision, Secure Firewall Threat Defense Software and UTD SNORT IPS Engine Software. Affected by this issue is some unknown functionality of the component Snort 3 Detection Engine. The manipulation results in missing report of error condition.
This vulnerability is identified as CVE-2026-20005. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
GHSA-pcm4-9fqw-4w8h: Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause
ghsa_unreviewed·2026-03-04
CVE-2026-20005 [MEDIUM] CWE-392 GHSA-pcm4-9fqw-4w8h: Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete parsing of the SSL handshake ingress packets. An attacker could exploit this vulnerability by sending crafted SSL handshake packets. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine restarts unexpectedly.
Cisco
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
vendor_cisco·2026-03-04·CVSS 5.8
CVE-2026-20005 [MEDIUM] CWE-248 Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz
This advisory is part of the March 2026 release of the Cisco Secure Firewall ASA, Secure FMC, and Secure
Cisco
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2026-20005 Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
CVE-2026-20005: Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-248, CWE-392, CWE-400, CWE-248, CWE-392, CWE-400, CWE-667, CWE-787, CWE-248, CWE-392, CWE-400, CWE-248, CWE-392, CWE-400, CWE-667, CWE-787
Bug IDs: CSCwn49805, CSCwn65473, CSCwo93207, CSCwn49805, CSCwn65473
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-04
Published