{"id":"CVE-2026-20058","title":"Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error ch…","summary":"Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error ch…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cwe":["CWE-786"],"vendor":"cisco","product":"snort","affected":["snort >= 3.0.0-233, < 3.9.6.0","secure_firewall_threat_defense = 7.2.0","secure_firewall_threat_defense = 7.2.0.1","secure_firewall_threat_defense = 7.2.1","secure_firewall_threat_defense = 7.2.2","secure_firewall_threat_defense = 7.2.3","secure_firewall_threat_defense = 7.2.4","secure_firewall_threat_defense = 7.2.4.1","secure_firewall_threat_defense = 7.2.5","secure_firewall_threat_defense = 7.2.5.1","secure_firewall_threat_defense = 7.2.5.2","secure_firewall_threat_defense = 7.2.6","secure_firewall_threat_defense = 7.2.7","secure_firewall_threat_defense = 7.2.8","secure_firewall_threat_defense = 7.2.8.1","secure_firewall_threat_defense = 7.2.9","secure_firewall_threat_defense = 7.2.10","secure_firewall_threat_defense = 7.2.10.2","secure_firewall_threat_defense = 7.3.0","secure_firewall_threat_defense = 7.3.1","secure_firewall_threat_defense = 7.3.1.1","secure_firewall_threat_defense = 7.3.1.2","secure_firewall_threat_defense = 7.4.0","secure_firewall_threat_defense = 7.4.1","secure_firewall_threat_defense = 7.4.1.1","secure_firewall_threat_defense = 7.4.2","secure_firewall_threat_defense = 7.4.2.1","secure_firewall_threat_defense = 7.4.2.2","secure_firewall_threat_defense = 7.4.2.3","secure_firewall_threat_defense = 7.4.2.4","secure_firewall_threat_defense = 7.4.3","secure_firewall_threat_defense = 7.6.0","secure_firewall_threat_defense = 7.6.1","secure_firewall_threat_defense = 7.6.2","secure_firewall_threat_defense = 7.6.2.1","secure_firewall_threat_defense = 7.7.0","secure_firewall_threat_defense = 7.7.10","secure_firewall_threat_defense = 7.7.10.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2"],"patched":["snort 3.9.6.0"],"published":"2026-03-04","updated":"2026-08-20","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20058","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed","label":"psirt@cisco.com"}],"tags":["nvd"],"epss":0.0039,"epssPercentile":0.32852,"ingestedAt":"2026-08-20T17:59:04.238Z","slug":"CVE-2026-20058","body":"## Overview\n\nMultiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition.\n\n## Affected\n\n- `snort >= 3.0.0-233, < 3.9.6.0`\n- `secure_firewall_threat_defense = 7.2.0`\n- `secure_firewall_threat_defense = 7.2.0.1`\n- `secure_firewall_threat_defense = 7.2.1`\n- `secure_firewall_threat_defense = 7.2.2`\n- `secure_firewall_threat_defense = 7.2.3`\n- `secure_firewall_threat_defense = 7.2.4`\n- `secure_firewall_threat_defense = 7.2.4.1`\n- `secure_firewall_threat_defense = 7.2.5`\n- `secure_firewall_threat_defense = 7.2.5.1`\n- `secure_firewall_threat_defense = 7.2.5.2`\n- `secure_firewall_threat_defense = 7.2.6`\n- `secure_firewall_threat_defense = 7.2.7`\n- `secure_firewall_threat_defense = 7.2.8`\n- `secure_firewall_threat_defense = 7.2.8.1`\n- `secure_firewall_threat_defense = 7.2.9`\n- `secure_firewall_threat_defense = 7.2.10`\n- `secure_firewall_threat_defense = 7.2.10.2`\n- `secure_firewall_threat_defense = 7.3.0`\n- `secure_firewall_threat_defense = 7.3.1`\n- `secure_firewall_threat_defense = 7.3.1.1`\n- `secure_firewall_threat_defense = 7.3.1.2`\n- `secure_firewall_threat_defense = 7.4.0`\n- `secure_firewall_threat_defense = 7.4.1`\n- `secure_firewall_threat_defense = 7.4.1.1`\n- `secure_firewall_threat_defense = 7.4.2`\n- `secure_firewall_threat_defense = 7.4.2.1`\n- `secure_firewall_threat_defense = 7.4.2.2`\n- `secure_firewall_threat_defense = 7.4.2.3`\n- `secure_firewall_threat_defense = 7.4.2.4`\n- `secure_firewall_threat_defense = 7.4.3`\n- `secure_firewall_threat_defense = 7.6.0`\n- `secure_firewall_threat_defense = 7.6.1`\n- `secure_firewall_threat_defense = 7.6.2`\n- `secure_firewall_threat_defense = 7.6.2.1`\n- `secure_firewall_threat_defense = 7.7.0`\n- `secure_firewall_threat_defense = 7.7.10`\n- `secure_firewall_threat_defense = 7.7.10.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snort 3.9.6.0`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}