{"id":"CVE-2026-20027","title":"Cisco Snort DCERPC Stub Data Out of Bounds Read","summary":"Multiple Cisco products are affected by vulnerabilities in the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Eng…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","vendor":"Cisco","product":"Cisco Firepower 1000 Series","affected":["firepower_2100_series","firepower_1000_series","asa_5500_x_series_firewalls","3000_series_industrial_security_appliances_isa","firepower_9000_series","firepower_4100_series","secure_firewall_threat_defense_virtual","secure_firewall_3100_series","secure_firewall_4200_series","secure_firewall_1200_series","utd_snort_ips_engine_software 17.12.1a","utd_snort_ips_engine_software 17.12.2","utd_snort_ips_engine_software 17.13.1a","utd_snort_ips_engine_software 17.12.3","utd_snort_ips_engine_software 17.14.1a","utd_snort_ips_engine_software 17.12.3a","utd_snort_ips_engine_software 17.12.4","utd_snort_ips_engine_software 17.15.1a","utd_snort_ips_engine_software 17.16.1a","utd_snort_ips_engine_software 17.12.4a","utd_snort_ips_engine_software 17.12.4b","utd_snort_ips_engine_software 17.12.5","utd_snort_ips_engine_software 17.12.5a","utd_snort_ips_engine_software 17.12.5b","utd_snort_ips_engine_software 17.15.2a","utd_snort_ips_engine_software 17.15.2c","utd_snort_ips_engine_software 17.15.3","utd_snort_ips_engine_software 17.15.3a","utd_snort_ips_engine_software 17.17.1","utd_snort_ips_engine_software 17.12.5c","utd_snort_ips_engine_software 17.15.4","utd_snort_ips_engine_software 17.18.1a","utd_snort_ips_engine_software 17.12.6","utd_snort_ips_engine_software 17.15.4c","utd_snort_ips_engine_software 17.12.5d","utd_snort_ips_engine_software 17.18.2"],"published":"2026-01-07","updated":"2026-02-10","sourceUpdated":"2026-02-10T20:42:07+00:00","source":"CSAF","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH"},{"url":"https://software.cisco.com"}],"tags":["csaf","vendor-advisory","cisco"],"epss":0.00596,"epssPercentile":0.47364,"ingestedAt":"2026-10-17T11:57:30.528Z","slug":"CVE-2026-20027","body":"## Overview\n\nMultiple Cisco products are affected by vulnerabilities in the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, which would result in an interruption of packet inspection.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nCisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities.\n\n## Vendor advisories\n\n- **cisco-sa-snort3-dcerpc-vulns-J9HNF4tH** · Cisco · affected: Cisco Firepower 2100 Series, Cisco Firepower 1000 Series, Cisco ASA 5500-X Series Firewalls, Cisco 3000 Series Industrial Security Appliances (ISA), Cisco Firepower 9000 Series, Cisco Firepower 4100 Series, … · updated 2026-02-10 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-dcerpc-vulns-J9HNF4tH)\n\n**Multiple Cisco Products Snort 3 Distributed Computing Environment/Remote Procedure Call Vulnerabilities**. Released 2026-01-07, updated 2026-02-10.\n\nAffected:\n\n- Cisco Firepower 2100 Series\n- Cisco Firepower 1000 Series\n- Cisco ASA 5500-X Series Firewalls\n- Cisco 3000 Series Industrial Security Appliances (ISA)\n- Cisco Firepower 9000 Series\n- Cisco Firepower 4100 Series\n- Cisco Secure Firewall Threat Defense Virtual\n- Cisco Secure Firewall 3100 Series\n- Cisco Secure Firewall 4200 Series\n- Cisco Secure Firewall 1200 Series\n- Cisco UTD SNORT IPS Engine Software 17.12.1a\n- Cisco UTD SNORT IPS Engine Software 17.12.2\n- Cisco UTD SNORT IPS Engine Software 17.13.1a\n- Cisco UTD SNORT IPS Engine Software 17.12.3\n- Cisco UTD SNORT IPS Engine Software 17.14.1a\n- Cisco UTD SNORT IPS Engine Software 17.12.3a\n- Cisco UTD SNORT IPS Engine Software 17.12.4\n- Cisco UTD SNORT IPS Engine Software 17.15.1a\n- Cisco UTD SNORT IPS Engine Software 17.16.1a\n- Cisco UTD SNORT IPS Engine Software 17.12.4a\n- Cisco UTD SNORT IPS Engine Software 17.12.4b\n- Cisco UTD SNORT IPS Engine Software 17.12.5\n- Cisco UTD SNORT IPS Engine Software 17.12.5a\n- Cisco UTD SNORT IPS Engine Software 17.12.5b\n- Cisco UTD SNORT IPS Engine Software 17.15.2a\n- Cisco UTD SNORT IPS Engine Software 17.15.2c\n- Cisco UTD SNORT IPS Engine Software 17.15.3\n- Cisco UTD SNORT IPS Engine Software 17.15.3a\n- Cisco UTD SNORT IPS Engine Software 17.17.1\n- Cisco UTD SNORT IPS Engine Software 17.12.5c\n- Cisco UTD SNORT IPS Engine Software 17.15.4\n- Cisco UTD SNORT IPS Engine Software 17.18.1a\n- Cisco UTD SNORT IPS Engine Software 17.12.6\n- Cisco UTD SNORT IPS Engine Software 17.15.4c\n- Cisco UTD SNORT IPS Engine Software 17.12.5d\n- Cisco UTD SNORT IPS Engine Software 17.18.2\n\n## Remediation\n\nCisco has released software updates that address this vulnerability. https://software.cisco.com","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}