{"id":"CVE-2026-20057","title":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.&nbsp;\r\n&nbsp;\r\nThis …","summary":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.&nbsp;\r\n&nbsp;\r\nThis …","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cwe":["CWE-369"],"vendor":"cisco","product":"snort","affected":["snort >= 3.0.0-233, < 3.9.3.0","cyber_vision = 3.0.0","cyber_vision = 3.0.1","cyber_vision = 3.0.2","cyber_vision = 3.0.3","cyber_vision = 3.0.4","cyber_vision = 3.0.5","cyber_vision = 3.0.6","cyber_vision = 3.1.0","cyber_vision = 3.1.1","cyber_vision = 3.1.2","cyber_vision = 3.2.0","cyber_vision = 3.2.1","cyber_vision = 3.2.2","cyber_vision = 3.2.3","cyber_vision = 3.2.4","cyber_vision = 4.0.0","cyber_vision = 4.0.1","cyber_vision = 4.0.2","cyber_vision = 4.0.3","cyber_vision = 4.1.0","cyber_vision = 4.1.1","cyber_vision = 4.1.2","cyber_vision = 4.1.3","cyber_vision = 4.1.4","cyber_vision = 4.1.5","cyber_vision = 4.1.6","cyber_vision = 4.1.7","cyber_vision = 4.2.0","cyber_vision = 4.2.1","cyber_vision = 4.2.2","cyber_vision = 4.2.3","cyber_vision = 4.2.4","cyber_vision = 4.2.6","cyber_vision = 4.3.0","cyber_vision = 4.3.1","cyber_vision = 4.3.2","cyber_vision = 4.3.3","cyber_vision = 4.4.0","cyber_vision = 4.4.1","cyber_vision = 4.4.2","cyber_vision = 4.4.3","cyber_vision = 5.0.0","cyber_vision = 5.0.1","cyber_vision = 5.0.2","cyber_vision = 5.1.0","cyber_vision = 5.1.1","cyber_vision = 5.1.2","cyber_vision = 5.1.3","cyber_vision = 5.2.0","cyber_vision = 5.2.1","cyber_vision = 5.3.0","cyber_vision = 5.3.1","secure_firewall_threat_defense = 7.2.0","secure_firewall_threat_defense = 7.2.0.1","secure_firewall_threat_defense = 7.2.1","secure_firewall_threat_defense = 7.2.2","secure_firewall_threat_defense = 7.2.3","secure_firewall_threat_defense = 7.2.4","secure_firewall_threat_defense = 7.2.4.1","secure_firewall_threat_defense = 7.2.5","secure_firewall_threat_defense = 7.2.5.1","secure_firewall_threat_defense = 7.2.5.2","secure_firewall_threat_defense = 7.2.6","secure_firewall_threat_defense = 7.2.7","secure_firewall_threat_defense = 7.2.8","secure_firewall_threat_defense = 7.2.8.1","secure_firewall_threat_defense = 7.2.9","secure_firewall_threat_defense = 7.2.10","secure_firewall_threat_defense = 7.2.10.2","secure_firewall_threat_defense = 7.3.0","secure_firewall_threat_defense = 7.3.1","secure_firewall_threat_defense = 7.3.1.1","secure_firewall_threat_defense = 7.3.1.2","secure_firewall_threat_defense = 7.4.0","secure_firewall_threat_defense = 7.4.1","secure_firewall_threat_defense = 7.4.1.1","secure_firewall_threat_defense = 7.4.2","secure_firewall_threat_defense = 7.4.2.1","secure_firewall_threat_defense = 7.4.2.2","secure_firewall_threat_defense = 7.4.2.3","secure_firewall_threat_defense = 7.4.2.4","secure_firewall_threat_defense = 7.4.3","secure_firewall_threat_defense = 7.6.0","secure_firewall_threat_defense = 7.6.1","secure_firewall_threat_defense = 7.6.2","secure_firewall_threat_defense = 7.6.2.1","secure_firewall_threat_defense = 7.7.0","secure_firewall_threat_defense = 7.7.10","secure_firewall_threat_defense = 7.7.10.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b"],"patched":["snort 3.9.3.0"],"published":"2026-03-04","updated":"2026-08-20","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20057","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed","label":"psirt@cisco.com"}],"tags":["nvd"],"epss":0.00432,"epssPercentile":0.36927,"ingestedAt":"2026-08-20T17:59:04.198Z","slug":"CVE-2026-20057","body":"## Overview\n\nMultiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.&nbsp;\r\n&nbsp;\r\nThis vulnerability is due to lack of proper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending a crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart causing a a denial of service (DoS) condition.\n\n## Affected\n\n- `snort >= 3.0.0-233, < 3.9.3.0`\n- `cyber_vision = 3.0.0`\n- `cyber_vision = 3.0.1`\n- `cyber_vision = 3.0.2`\n- `cyber_vision = 3.0.3`\n- `cyber_vision = 3.0.4`\n- `cyber_vision = 3.0.5`\n- `cyber_vision = 3.0.6`\n- `cyber_vision = 3.1.0`\n- `cyber_vision = 3.1.1`\n- `cyber_vision = 3.1.2`\n- `cyber_vision = 3.2.0`\n- `cyber_vision = 3.2.1`\n- `cyber_vision = 3.2.2`\n- `cyber_vision = 3.2.3`\n- `cyber_vision = 3.2.4`\n- `cyber_vision = 4.0.0`\n- `cyber_vision = 4.0.1`\n- `cyber_vision = 4.0.2`\n- `cyber_vision = 4.0.3`\n- `cyber_vision = 4.1.0`\n- `cyber_vision = 4.1.1`\n- `cyber_vision = 4.1.2`\n- `cyber_vision = 4.1.3`\n- `cyber_vision = 4.1.4`\n- `cyber_vision = 4.1.5`\n- `cyber_vision = 4.1.6`\n- `cyber_vision = 4.1.7`\n- `cyber_vision = 4.2.0`\n- `cyber_vision = 4.2.1`\n- `cyber_vision = 4.2.2`\n- `cyber_vision = 4.2.3`\n- `cyber_vision = 4.2.4`\n- `cyber_vision = 4.2.6`\n- `cyber_vision = 4.3.0`\n- `cyber_vision = 4.3.1`\n- `cyber_vision = 4.3.2`\n- `cyber_vision = 4.3.3`\n- `cyber_vision = 4.4.0`\n- `cyber_vision = 4.4.1`\n- `cyber_vision = 4.4.2`\n- `cyber_vision = 4.4.3`\n- `cyber_vision = 5.0.0`\n- `cyber_vision = 5.0.1`\n- `cyber_vision = 5.0.2`\n- `cyber_vision = 5.1.0`\n- `cyber_vision = 5.1.1`\n- `cyber_vision = 5.1.2`\n- `cyber_vision = 5.1.3`\n- `cyber_vision = 5.2.0`\n- `cyber_vision = 5.2.1`\n- `cyber_vision = 5.3.0`\n- `cyber_vision = 5.3.1`\n- `secure_firewall_threat_defense = 7.2.0`\n- `secure_firewall_threat_defense = 7.2.0.1`\n- `secure_firewall_threat_defense = 7.2.1`\n- `secure_firewall_threat_defense = 7.2.2`\n- `secure_firewall_threat_defense = 7.2.3`\n- `secure_firewall_threat_defense = 7.2.4`\n- `secure_firewall_threat_defense = 7.2.4.1`\n- `secure_firewall_threat_defense = 7.2.5`\n- `secure_firewall_threat_defense = 7.2.5.1`\n- `secure_firewall_threat_defense = 7.2.5.2`\n- `secure_firewall_threat_defense = 7.2.6`\n- `secure_firewall_threat_defense = 7.2.7`\n- `secure_firewall_threat_defense = 7.2.8`\n- `secure_firewall_threat_defense = 7.2.8.1`\n- `secure_firewall_threat_defense = 7.2.9`\n- `secure_firewall_threat_defense = 7.2.10`\n- `secure_firewall_threat_defense = 7.2.10.2`\n- `secure_firewall_threat_defense = 7.3.0`\n- `secure_firewall_threat_defense = 7.3.1`\n- `secure_firewall_threat_defense = 7.3.1.1`\n- `secure_firewall_threat_defense = 7.3.1.2`\n- `secure_firewall_threat_defense = 7.4.0`\n- `secure_firewall_threat_defense = 7.4.1`\n- `secure_firewall_threat_defense = 7.4.1.1`\n- `secure_firewall_threat_defense = 7.4.2`\n- `secure_firewall_threat_defense = 7.4.2.1`\n- `secure_firewall_threat_defense = 7.4.2.2`\n- `secure_firewall_threat_defense = 7.4.2.3`\n- `secure_firewall_threat_defense = 7.4.2.4`\n- `secure_firewall_threat_defense = 7.4.3`\n- `secure_firewall_threat_defense = 7.6.0`\n- `secure_firewall_threat_defense = 7.6.1`\n- `secure_firewall_threat_defense = 7.6.2`\n- `secure_firewall_threat_defense = 7.6.2.1`\n- `secure_firewall_threat_defense = 7.7.0`\n- `secure_firewall_threat_defense = 7.7.10`\n- `secure_firewall_threat_defense = 7.7.10.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snort 3.9.3.0`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}